From faab04ccbc013f87a3589a9da98182ee27031cf7 Mon Sep 17 00:00:00 2001
From: Bob Gendler <robert.gendler@nist.gov>
Date: Tue, 9 Sep 2025 15:25:26 -0400
Subject: [PATCH] Updated generate scap, scap 1.4, oval 5.12.1

---
 scripts/generate_scap.py | 2945 ++------------------------------------
 1 file changed, 116 insertions(+), 2829 deletions(-)

diff --git a/scripts/generate_scap.py b/scripts/generate_scap.py
index 2a57eb58..7eaf5a16 100755
--- a/scripts/generate_scap.py
+++ b/scripts/generate_scap.py
@@ -158,6 +158,7 @@ def generate_scap(all_rules, all_baselines, args, stig):
 
     now = datetime.now()
     date_time_string = now.strftime("%Y-%m-%dT%H:%M:%S")
+    year = now.year
 
     filenameversion = version_yaml['version'].split(",")[1].replace(" ", "_")[1:]
     output = "../build/macOS_{0}_Security_Compliance_Benchmark-{1}".format(version_yaml['os'],filenameversion)
@@ -187,13 +188,13 @@ def generate_scap(all_rules, all_baselines, args, stig):
     d = 1
 
     ovalPrefix = '''<?xml version="1.0" encoding="UTF-8"?>
-    <oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="   http://oval.mitre.org/XMLSchema/oval-definitions-5             https://raw.githubusercontent.com/OVALProject/Language/5.11.2/schemas/oval-definitions-schema.xsd  http://oval.mitre.org/XMLSchema/oval-definitions-5#independent https://raw.githubusercontent.com/OVALProject/Language/5.11.2/schemas/independent-definitions-schema.xsd    http://oval.mitre.org/XMLSchema/oval-definitions-5#macos       https://raw.githubusercontent.com/OVALProject/Language/5.11.2/schemas/macos-definitions-schema.xsd  http://oval.mitre.org/XMLSchema/oval-definitions-5#unix        https://raw.githubusercontent.com/OVALProject/Language/5.11.2/schemas/unix-definitions-schema.xsd">
+    <oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5 https://raw.githubusercontent.com/OVAL-Community/OVAL/master/oval-schemas/oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent https://raw.githubusercontent.com/OVAL-Community/OVAL/master/oval-schemas/independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#macos https://raw.githubusercontent.com/OVAL-Community/OVAL/master/oval-schemas/macos-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix https://raw.githubusercontent.com/OVAL-Community/OVAL/master/oval-schemas/unix-definitions-schema.xsd">
       <generator>
-        <oval:schema_version xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5">5.11.2</oval:schema_version>
+        <oval:schema_version>5.12.1</oval:schema_version>
         <oval:timestamp xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5">{0}</oval:timestamp>
-        <terms_of_use>Copyright (c) 2020, NIST.</terms_of_use>
+        <terms_of_use>Copyright (c) {1}, NIST.</terms_of_use>
         <oval:product_name xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5">macOS Security Compliance Project</oval:product_name>
-      </generator>'''.format(date_time_string)
+      </generator>'''.format(date_time_string, year)
 
     ostype = "macOS"
     if "ios" in version_yaml['cpe'] or "visionos" in version_yaml['cpe']:
@@ -202,7 +203,7 @@ def generate_scap(all_rules, all_baselines, args, stig):
             ostype = "visionOS"
 
     xccdfPrefix = '''<?xml version="1.0" encoding="UTF-8"?>
-    <Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_gov.nist.mscp.content_benchmark_macOS_{1}" style="SCAP_1.3" resolved="true" xml:lang="en">
+    <Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_gov.nist.mscp.content_benchmark_macOS_{1}" style="SCAP_1.4" resolved="true" xml:lang="en">
       <status date="{3}">draft</status>
       <title>{4} {1}: Security Configuration</title>
       <description>
@@ -226,8 +227,8 @@ def generate_scap(all_rules, all_baselines, args, stig):
     '''.format(date_time_string, version_yaml['os'], version_yaml['version'],date_time_string.split("T")[0] + "Z", ostype)
 
     scapPrefix = '''<?xml version="1.0" encoding="UTF-8"?>
-<data-stream-collection xmlns="http://scap.nist.gov/schema/scap/source/1.2" id="scap_gov.nist.mscp.content_collection_macOS_{1}" schematron-version="1.3">
-  <data-stream timestamp="{0}" id="scap_gov.nist.mscp.content_datastream_macOS_{1}" scap-version="1.3" use-case="CONFIGURATION">
+<data-stream-collection xmlns="http://scap.nist.gov/schema/scap/source/1.2" id="scap_gov.nist.mscp.content_collection_macOS_{1}" schematron-version="1.4">
+  <data-stream timestamp="{0}" id="scap_gov.nist.mscp.content_datastream_macOS_{1}" scap-version="1.4" use-case="CONFIGURATION">
     <dictionaries>
       <component-ref xmlns:ns0="http://www.w3.org/1999/xlink" id="scap_gov.nist.mscp.content_cref_macOS_{1}_macOS-cpe-dictionary.xml" ns0:type="simple" ns0:href="#scap_gov.nist.mscp.content_comp_macOS_{1}_macOS-cpe-dictionary.xml">
         <catalog xmlns="urn:oasis:names:tc:entity:xmlns:xml:catalog">
@@ -250,7 +251,7 @@ def generate_scap(all_rules, all_baselines, args, stig):
     </checks>
   </data-stream>
   <component id="scap_gov.nist.mscp.content_comp_macOS_{1}_xccdf.xml" timestamp="{0}">
-    <Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_gov.nist.mscp.content_benchmark_macOS_{1}" style="SCAP_1.3" resolved="true" xml:lang="en">
+    <Benchmark xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_gov.nist.mscp.content_benchmark_macOS_{1}" style="SCAP_1.4" resolved="true" xml:lang="en">
       <status date="{4}">draft</status>
       <title>macOS {1}: Security Configuration</title>
       <description>
@@ -300,27 +301,18 @@ def generate_scap(all_rules, all_baselines, args, stig):
         for a in range(0, loop):
             
             rule_yaml = get_rule_yaml(rule_file, custom)
-            
-            try:           
+
+            try:
+                odv_keys = list(rule_yaml['odv'].keys())
                 
-                # # odv_label = list(rule_yaml['odv'].keys())[a]
-                # # odv_label.remove('hint')
                 if args.baseline != "None":
-                    odv_label = args.baseline
-                    if args.baseline not in list(rule_yaml['odv'].keys())[a]:
+                    if args.baseline in odv_keys:
+                        odv_label = args.baseline
+                    else:
                         odv_label = "recommended"
-                # if args.baseline not in list(rule_yaml['odv'].keys())[a]:
-                #     odv_label = "recommended"
                 else:
-                    odv_label = list(rule_yaml['odv'].keys())[a]
-
+                    odv_label = odv_keys[a]
                     
-                    
-
-                # if odv_label == "hint":
-                #     continue
-                
-                
 
                 odv_value = str(rule_yaml['odv'][odv_label])
                 rule_yaml['title'] = rule_yaml['title'].replace("$ODV",str(odv_value))
@@ -482,7 +474,7 @@ def generate_scap(all_rules, all_baselines, args, stig):
             <fixtext>{7}</fixtext>
             {8}
             </Rule>
-            '''.format(rule_yaml['id'] + "_" + odv_label, severity, rule_yaml['title'], rule_yaml['discussion'].replace("<","&lt;").replace(">","&gt;").replace("&","&amp;").rstrip(), rule_yaml['check'].replace("<","&lt;").replace(">","&gt;").replace("&","&amp;").rstrip(), result, cce,rule_yaml['fix'].replace("<","&lt;").replace(">","&gt;").replace("&","&amp;")  + "\n" + mobileconfig_info, check_rule, references)
+            '''.format(rule_yaml['id'] + "_" + odv_label, severity, rule_yaml['title'], escape(rule_yaml['discussion']).rstrip(), escape(rule_yaml['check']).rstrip(), result, cce,escape(rule_yaml['fix'])  + "\n" + mobileconfig_info, check_rule, references)
 
             if export_as == "xccdf":
                 mobileconfig_info = ""
@@ -501,7 +493,7 @@ def generate_scap(all_rules, all_baselines, args, stig):
             <fixtext>{7}</fixtext>
             
             </Rule>
-            '''.format(rule_yaml['id'] + "_" + odv_label, severity, rule_yaml['title'], rule_yaml['discussion'].replace("<","&lt;").replace(">","&gt;").replace("&","&amp;").rstrip(), rule_yaml['check'].replace("<","&lt;").replace(">","&gt;").replace("&","&amp;").rstrip(), result, cce,rule_yaml['fix'].replace("<","&lt;").replace(">","&gt;").replace("&","&amp;") + "\n" + mobileconfig_info, references)
+            '''.format(rule_yaml['id'] + "_" + odv_label, severity, rule_yaml['title'], escape(rule_yaml['discussion']).rstrip(), escape(rule_yaml['check']).rstrip(), result, cce,escape(rule_yaml['fix']) + "\n" + mobileconfig_info, references)
                 continue
                 
 
@@ -509,2811 +501,112 @@ def generate_scap(all_rules, all_baselines, args, stig):
             if "inherent" in rule_yaml['tags'] or "n_a" in rule_yaml['tags'] or "permanent" in rule_yaml['tags']:
                 xccdf_rules = replace_ocil(xccdf_rules,x)
                 x += 1
-                continue
-            if "time_machine" in rule_yaml['id'] and "encrypted" in rule_yaml['id']:
-                print(rule_yaml['id'] + " - Manual Check Required")
-                xccdf_rules = replace_ocil(xccdf_rules,x)
-                x += 1
-                continue
-            if "objectIsForcedForKey" in rule_yaml['check']:
-                print(rule_yaml['id'] + " - Manual Check")
-                xccdf_rules = replace_ocil(xccdf_rules,x)
-                x += 1
-                continue
-            if "bluetooth" in rule_yaml['id'] and "unpaired" in rule_yaml['id']:
-                print(rule_yaml['id'] + " - Manual Check Required")
-                xccdf_rules = replace_ocil(xccdf_rules,x)
-                x += 1
-                continue
-            if rule_yaml['check'][0] != "/" and "[source,bash]" not in rule_yaml['fix']:
-                print(rule_yaml['id'] + " - Manual Check")
-                xccdf_rules = replace_ocil(xccdf_rules,x)
-                x += 1
-                continue
-            if "hint" in rule_yaml['check'] and "dscl" in rule_yaml['check']:
-                print(rule_yaml['id'] + " - no relevant oval")
-                xccdf_rules = replace_ocil(xccdf_rules,x)
-                x += 1
-                continue
+                continue            
             if "manual" in rule_yaml['tags']:
                 print(rule_yaml['id'] + " - Manual Check")
                 xccdf_rules = replace_ocil(xccdf_rules,x)
                 x += 1
                 continue
-            if "eficheck" in rule_yaml['check']:
-                print(rule_yaml['id'] + " - eficheck - no relevant oval")
-                xccdf_rules = replace_ocil(xccdf_rules,x)
-                x += 1
-                continue
-            if "newsyslog.conf" in rule_yaml['check'] or "asl.conf" in rule_yaml['check'] or "aslmanager" in rule_yaml['check']:
-                print(rule_yaml['id'] + " - Manual Check Required")
-                xccdf_rules = replace_ocil(xccdf_rules,x)
-                x += 1
-                continue
-            if "/usr/bin/pwpolicy getaccountpolicies" in rule_yaml['check']:
-                print(rule_yaml['id'] + " - pwpolicy getaccountpolicies - no relevant oval")
-                xccdf_rules = replace_ocil(xccdf_rules,x)
-                x += 1
-                continue
-            if "find" in rule_yaml['check'].split(" ")[0] and rule_yaml['id'] != "os_home_folders_secure":
-                print(rule_yaml['id'] + " - no relevant oval")
-                xccdf_rules = replace_ocil(xccdf_rules,x)
-                x += 1
-                continue
-            if "/usr/sbin/firmwarepasswd" in rule_yaml['check']:
-                print(rule_yaml['id'] + " - no relevant oval")
-                xccdf_rules = replace_ocil(xccdf_rules,x)
-                x += 1
-                continue
-            if "os_home_folders_secure" in rule_yaml['id']:
-                oval_definition = oval_definition + '''
-                        <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                        <title>{}</title> 
-                        <reference source="CCE" ref_id="{}"/>
-                        <reference source="macos_security" ref_id="{}"/>
-                        <description>{}</description> 
-                    </metadata> 
-                <criteria>
-                    <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                </criteria>
-            </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label, rule_yaml['discussion'],rule_yaml['id'] + "_" + odv_label,x)
-
-                oval_test = oval_test + '''
-                    <file_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" check_existence="all_exist" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                <object object_ref="oval:mscp:obj:{}" />
-                <state state_ref="oval:mscp:ste:{}" />
-            </file_test>'''.format(rule_yaml['id'] + "_" + odv_label,x,x,x)
-
-                oval_object = oval_object + '''
-            <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-            <path datatype="string" operation="equals" var_ref="oval:mscp:var:{}"></path>
-            <filename xsi:nil="true"/>
             
-            </file_object>
-
-            <accountinfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="user home directory" id="oval:mscp:obj:{}" version="1">
-                <username operation="pattern match">.*</username>
-                <filter action="include" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5">oval:mscp:ste:{}</filter>
-            </accountinfo_object>'''.format(rule_yaml['id'] + "_" + odv_label,x,x,x+999,x+999)
-
-                oval_state = oval_state + '''
-                <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-            <uread datatype="boolean">true</uread>
-            <uwrite datatype="boolean">true</uwrite>
-            <uexec datatype="boolean">true</uexec>
-            <gread datatype="boolean">false</gread>
-            <gwrite datatype="boolean">false</gwrite>
-            <gexec datatype="boolean">false</gexec>
-            <oread datatype="boolean">false</oread>
-            <owrite datatype="boolean">false</owrite>
-            <oexec datatype="boolean">false</oexec>
-            </file_state>
-
-        <accountinfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="accountinfo_state" id="oval:mscp:ste:{}" version="1">
-                <username operation="pattern match">^[^_\s].*</username>
-                <uid datatype="int" operation="not equal">0</uid>
-                <gid datatype="int" operation="not equal">0</gid>
-                <login_shell operation="not equal">/usr/bin/false</login_shell>
-            </accountinfo_state>'''.format(rule_yaml['id'] + "_" + odv_label,x,x+999)
-
-                oval_variable = oval_variable + '''
-                    <local_variable id="oval:mscp:var:{}" version="1" datatype="string" comment="home directory variable">
-                <object_component object_ref="oval:mscp:obj:{}" item_field="home_dir"/>
-        </local_variable>'''.format(x,x+999)
-                x = x + 1
-                continue
-            
-            if rule_yaml['mobileconfig']:
-                if "spctl" in rule_yaml['check']:
-                    
-                    if "verbose" in rule_yaml['check']:
-                        xccdf_rules = replace_ocil(xccdf_rules,x)
-                        x = x + 1
-                        continue
-                    else:
-                        
-                        oval_definition = oval_definition + '''
-            <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                        <title>{}</title>
-                        <reference source="CCE" ref_id="{}"/>
-                        <reference source="macos_security" ref_id="{}"/>
-                        <description>{}</description> 
-                    </metadata> 
-                <criteria>
-                    <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-
-                </criteria>
-            </definition>'''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].rstrip(),rule_yaml['id'] + "_" + odv_label,x)
-
-                        oval_test = oval_test + '''
-            <gatekeeper_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="only_one_exists" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                <object object_ref="oval:mscp:obj:{}"/>
-                <state state_ref="oval:mscp:ste:{}" />
-            </gatekeeper_test>'''.format(rule_yaml['id'] + "_" + odv_label,x,x,x)
-
-                        oval_object = oval_object + '''
-            <gatekeeper_object id="oval:mscp:obj:{}" version="1" comment="{}_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos">
-            </gatekeeper_object>'''.format(x,rule_yaml['id'])
-
-                        oval_state = oval_state + '''
-            <gatekeeper_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-                <enabled datatype="boolean" operation="equals">true</enabled>
-            </gatekeeper_state>'''.format(rule_yaml['id'] + "_" + odv_label,x)
-
-                    
-                    x += 1
-                    continue
-                
-                for payload_type, info in rule_yaml['mobileconfig_info'].items():
-                    
-                    if payload_type == "com.apple.systempolicy.control":
-                        continue
-                    if payload_type == "com.apple.ManagedClient.preferences":
-                        for payload_domain, settings in info.items():
-                            oval_definition = oval_definition + '''
-                            <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                            <metadata> 
-                                <title>{}</title>
-                                <reference source="CCE" ref_id="{}"/>
-                                <reference source="macos_security" ref_id="{}"/>
-                                <description>{}</description> 
-                            </metadata>'''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].rstrip())
-                            if len(settings) > 1:
-                                oval_definition = oval_definition + '''<criteria operator="AND">'''
-                            else:
-                                oval_definition = oval_definition + '''<criteria>'''
-                            
-                            for key, value in settings.items():
-                                state_kind = ""
-                                if type(value) == bool:
-                                    state_kind = "boolean"
-                                elif type(value) == int:
-                                    state_kind = "int"
-                                elif type(value) == str:
-                                    state_kind = "string"
-                                
-                                dz = d + 5000
-                                oval_definition = oval_definition + '''<criterion comment="{}" test_ref="oval:mscp:tst:{}" />'''.format(rule_yaml['id'] + '_' + odv_label + "_" + str(d), dz)
-
-                                oval_test = oval_test + '''
-                    <plist511_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="only_one_exists" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                        <object object_ref="oval:mscp:obj:{}" />
-                        <state state_ref="oval:mscp:ste:{}" />
-                    </plist511_test>
-                
-                
-                '''.format(rule_yaml['id'] + "_" + odv_label + "_" + str(d),dz,dz,dz)
-                                if payload_domain == "com.apple.dock":
-                                    
-                                    oval_object = oval_object + '''
-                <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" version="1" comment="find a username" id="oval:mscp:obj:{}">
-                    <filepath>/Library/Preferences/com.apple.loginwindow.plist</filepath>
-                    <xpath>/plist/dict/key[string()="lastUserName"]/following-sibling::*[1]/text()</xpath>
-                </plist511_object>
-                    <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                <filepath datatype="string" operation="equals" var_check="at least one" var_ref="oval:mscp:var:{}"/>
-                <xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-            </plist511_object>'''.format(x+1999,key,dz,x,key)
-
-                                    oval_variable = oval_variable + '''
-        <local_variable id="oval:mscp:var:{}" version="1" datatype="string" comment="user managed pref variable">
-            <concat>
-                    <literal_component datatype="string">/Library/Managed Preferences/</literal_component>
-                    <object_component object_ref="oval:mscp:obj:{}" item_field="value_of"/>
-                    <literal_component datatype="string">/com.apple.dock.plist</literal_component>
-            </concat>
-        </local_variable>'''.format(x,x+1999)
-
-                                else:
-                                    oval_object = oval_object + '''
-                        <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                            <filepath>/Library/Managed Preferences/{}.plist</filepath>
-                            <xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-
-                        </plist511_object>
-                        '''.format(rule_yaml['id'] + "_" + odv_label,dz,payload_domain,key)
-                                    
-                                
-                                oval_state = oval_state + '''
-                                    <plist511_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-                        <value_of datatype="{}" operation="equals">{}</value_of>
-                        </plist511_state>
-                        '''.format(rule_yaml['id'] + "_" + odv_label,dz,state_kind,value)
-                                d += 1
-                                x += 1
-                        oval_definition = oval_definition + '''</criteria> </definition>'''
-                        continue
-                    for key, value in info.items():
-                        if key == "familyControlsEnabled":
-                            xpath_search = ""
-                            if len(info) > 1:
-                                
-                                xpath_search = info['pathBlackList']
-                                oval_definition = oval_definition + '''
-                    <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                        <title>{}</title> 
-                        <reference source="CCE" ref_id="{}"/>
-                        <reference source="macos_security" ref_id="{}"/>
-                        <description>{}</description> 
-                    </metadata> 
-                <criteria> 
-                    <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                </criteria> 
-            </definition>
-            '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].rstrip().replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x)
-
-                                oval_test = oval_test + '''
-            <plist511_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="only_one_exists" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                <object object_ref="oval:mscp:obj:{}" />
-                <state state_ref="oval:mscp:ste:{}" />
-            </plist511_test>
-        '''.format(rule_yaml['id'] + "_" + odv_label,x,x,x)
-                                ""
-                                oval_object = oval_object + '''
-            <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                    <filepath>/Library/Managed Preferences/com.apple.applicationaccess.new.plist</filepath>
-                    <xpath>boolean(plist/dict/array/string/text() = "{}")</xpath>
-            </plist511_object>
-            '''.format(rule_yaml['id'] + "_" + odv_label,x,str(xpath_search).replace('[',"").replace(']',"").replace("'",""))
-                            
-                                oval_state = oval_state + '''
-                        <plist511_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-            <value_of datatype="boolean" operation="equals">true</value_of>
-            </plist511_state>
-            '''.format(rule_yaml['id'] + "_" + odv_label,x)
-                                
-                                x = x + 1
-                                continue
-                            else:
-                                
-                                oval_definition = oval_definition + '''
-                    <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                        <title>{}</title> 
-                        <reference source="CCE" ref_id="{}"/>
-                        <reference source="macos_security" ref_id="{}"/>
-                        <description>{}</description> 
-                    </metadata> 
-                <criteria> 
-                    <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                </criteria> 
-            </definition>
-            '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].rstrip(),rule_yaml['id'] + "_" + odv_label,x)
-
-                                oval_test = oval_test + '''
-            <plist511_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="only_one_exists" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                <object object_ref="oval:mscp:obj:{}" />
-                <state state_ref="oval:mscp:ste:{}" />
-            </plist511_test>
-        '''.format(rule_yaml['id'] + "_" + odv_label,x,x,x)
-                                                                
-                                oval_object = oval_object + '''
-            <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                <filepath>/Library/Managed Preferences/{}.plist</filepath>'''.format(rule_yaml['id'] + "_" + odv_label,x,payload_type)
-                    
-                                state_kind = ""
-                                if type(value) == bool:
-                                    oval_object = oval_object + '''
-    <xpath>name(//*[contains(text(), "{}")]/following-sibling::*[1])</xpath>
-    </plist511_object>'''.format(key)
-                                    state_kind = "boolean"
-                                elif type(value) == int:
-                                    state_kind = "int"
-                                    oval_object = oval_object + '''
-    <xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-    </plist511_object>'''.format(key)
-                                elif type(value) == str:
-                                    state_kind = "string"
-                                    oval_object = oval_object + '''
-    <xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-    </plist511_object>'''.format(key)
-
-                                oval_state = oval_state + '''
-                        <plist511_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-            <value_of datatype="{}" operation="equals">{}</value_of>
-            </plist511_state>
-            '''.format(rule_yaml['id'] + "_" + odv_label,x,state_kind,value)
-
-                                x = x + 1
-                                continue
-                        if payload_type == "com.apple.finder":
-                            oval_definition = oval_definition + '''
-                    <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                        <title>{}</title>
-                        <reference source="CCE" ref_id="{}"/>
-                        <reference source="macos_security" ref_id="{}"/>
-                        <description>{}</description> 
-                    </metadata> 
-                <criteria> 
-                    <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                </criteria> 
-            </definition>
-            '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].rstrip().replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x)
-
-                            oval_test = oval_test + '''
-            <plist511_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="only_one_exists" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                <object object_ref="oval:mscp:obj:{}" />
-                <state state_ref="oval:mscp:ste:{}" />
-            </plist511_test>
-        '''.format(rule_yaml['id'] + "_" + odv_label,x,x,x)
-
-                            oval_object = oval_object + '''
-            <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" version="1" comment="find a username" id="oval:mscp:obj:{}">
-                <filepath>/Library/Preferences/com.apple.loginwindow.plist</filepath>
-                <xpath>/plist/dict/key[string()="lastUserName"]/following-sibling::*[1]/text()</xpath>
-            </plist511_object>
-            <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                <filepath datatype="string" operation="equals" var_check="at least one" var_ref="oval:mscp:var:{}"/>
-            '''.format(x+1999,rule_yaml['id'] + "_" + odv_label,x,x)
-                                                    
-                            state_kind = ""
-                            if type(value) == bool:
-                                oval_object = oval_object + '''
-    <xpath>name(//*[contains(text(), "{}")]/following-sibling::*[1])</xpath>
-    </plist511_object>'''.format(key)
-                                state_kind = "boolean"
-                            elif type(value) == int:
-                                state_kind = "int"
-                                oval_object = oval_object + '''
-    <xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-    </plist511_object>'''.format(key)
-                            elif type(value) == str:
-                                state_kind = "string"
-                                oval_object = oval_object + '''
-    <xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-    </plist511_object>'''.format(key)
-
-                            oval_state = oval_state + '''
-                    <plist511_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-        <value_of datatype="{}" operation="equals">{}</value_of>
-        </plist511_state>
-        '''.format(rule_yaml['id'] + "_" + odv_label,x,state_kind,value)
-
-
-                            oval_variable = oval_variable +           '''    
-            <local_variable id="oval:mscp:var:{}" version="1" datatype="string" comment="user managed pref">
-                <concat>
-                    <literal_component datatype="string">/Library/Managed Preferences/</literal_component>
-                    <object_component object_ref="oval:mscp:obj:{}" item_field="value_of"/>
-                    <literal_component datatype="string">/com.apple.finder.plist</literal_component>
-                </concat>
-            </local_variable>'''.format(x,x+1999)
-                            x += 1
-                            continue
-                        
-                        if payload_type == "com.apple.DiscRecording":
-                            oval_definition = oval_definition + '''
-                    <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                        <title>{}</title>
-                        <reference source="CCE" ref_id="{}"/>
-                        <reference source="macos_security" ref_id="{}"/>
-                        <description>{}</description> 
-                    </metadata> 
-                <criteria> 
-                    <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                </criteria> 
-            </definition>
-            '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].rstrip().replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x)
-
-                            oval_test = oval_test + '''
-            <plist511_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="only_one_exists" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                <object object_ref="oval:mscp:obj:{}" />
-                <state state_ref="oval:mscp:ste:{}" />
-            </plist511_test>
-        '''.format(rule_yaml['id'] + "_" + odv_label,x,x,x)
-
-                            oval_object = oval_object + '''
-            <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" version="1" comment="find a username" id="oval:mscp:obj:{}">
-                <filepath>/Library/Preferences/com.apple.loginwindow.plist</filepath>
-                <xpath>/plist/dict/key[string()="lastUserName"]/following-sibling::*[1]/text()</xpath>
-            </plist511_object>
-            <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                <filepath datatype="string" operation="equals" var_check="at least one" var_ref="oval:mscp:var:{}"/>
-            '''.format(x+1999,rule_yaml['id'] + "_" + odv_label,x,x)
-                            
-                            state_kind = ""
-                            if type(value) == bool:
-                                oval_object = oval_object + '''
-    <xpath>name(//*[contains(text(), "{}")]/following-sibling::*[1])</xpath>
-    </plist511_object>'''.format(key)
-                                state_kind = "boolean"
-                            elif type(value) == int:
-                                state_kind = "int"
-                                oval_object = oval_object + '''
-    <xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-    </plist511_object>'''.format(key)
-                            elif type(value) == str:
-                                state_kind = "string"
-                                oval_object = oval_object + '''
-    <xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-    </plist511_object>'''.format(key)
-
-                            oval_state = oval_state + '''
-                    <plist511_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-        <value_of datatype="{}" operation="equals">{}</value_of>
-        </plist511_state>
-        '''.format(rule_yaml['id'] + "_" + odv_label,x,state_kind,value)
-
-
-                            oval_variable = oval_variable +           '''    
-            <local_variable id="oval:mscp:var:{}" version="1" datatype="string" comment="user managed pref">
-                <concat>
-                    <literal_component datatype="string">/Library/Managed Preferences/</literal_component>
-                    <object_component object_ref="oval:mscp:obj:{}" item_field="value_of"/>
-                    <literal_component datatype="string">/com.apple.DiscRecording.plist</literal_component>
-                </concat>
-            </local_variable>'''.format(x,x+1999)
-                            x += 1
-                            continue      
-                        if payload_type == "com.apple.Safari" and key == "AutoOpenSafeDownloads":
-                            oval_definition = oval_definition + '''
-                    <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                        <title>{}</title>
-                        <reference source="CCE" ref_id="{}"/>
-                        <reference source="macos_security" ref_id="{}"/>
-                        <description>{}</description> 
-                    </metadata> 
-                <criteria> 
-                    <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                </criteria> 
-            </definition>
-            '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].rstrip().replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x)
-
-                            oval_test = oval_test + '''
-            <plist511_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="only_one_exists" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                <object object_ref="oval:mscp:obj:{}" />
-                <state state_ref="oval:mscp:ste:{}" />
-            </plist511_test>
-        '''.format(rule_yaml['id'] + "_" + odv_label,x,x,x)
-
-                            oval_object = oval_object + '''
-            <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" version="1" comment="find a username" id="oval:mscp:obj:{}">
-                <filepath>/Library/Preferences/com.apple.loginwindow.plist</filepath>
-                <xpath>/plist/dict/key[string()="lastUserName"]/following-sibling::*[1]/text()</xpath>
-            </plist511_object>
-            <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                <filepath datatype="string" operation="equals" var_check="at least one" var_ref="oval:mscp:var:{}"/>
-            '''.format(x+1999,rule_yaml['id'] + "_" + odv_label,x,x)
-                            
-                            state_kind = ""
-                            if type(value) == bool:
-                                oval_object = oval_object + '''
-    <xpath>name(//*[contains(text(), "{}")]/following-sibling::*[1])</xpath>
-    </plist511_object>'''.format(key)
-                                state_kind = "boolean"
-                            elif type(value) == int:
-                                state_kind = "int"
-                                oval_object = oval_object + '''
-    <xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-    </plist511_object>'''.format(key)
-                            elif type(value) == str:
-                                state_kind = "string"
-                                oval_object = oval_object + '''
-    <xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-    </plist511_object>'''.format(key)
-
-                            oval_state = oval_state + '''
-                    <plist511_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-        <value_of datatype="{}" operation="equals">{}</value_of>
-        </plist511_state>
-        '''.format(rule_yaml['id'] + "_" + odv_label,x,state_kind,value)
-
-
-                            oval_variable = oval_variable +           '''    
-            <local_variable id="oval:mscp:var:{}" version="1" datatype="string" comment="user managed pref">
-                <concat>
-                    <literal_component datatype="string">/Library/Managed Preferences/</literal_component>
-                    <object_component object_ref="oval:mscp:obj:{}" item_field="value_of"/>
-                    <literal_component datatype="string">/com.apple.Safari.plist</literal_component>
-                </concat>
-            </local_variable>'''.format(x,x+1999)
-                            x += 1
-                            continue                                                       
-                        if payload_type == "com.apple.systempreferences" and key == "DisabledPreferencePanes" or payload_type == "com.apple.systempreferences" and key == "HiddenPreferencePanes" or payload_type == "com.apple.systempreferences" and key == "DisabledSystemSettings": 
-                            
-                            oval_definition = oval_definition + '''
-                    <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                        <title>{}</title>
-                        <reference source="CCE" ref_id="{}"/>
-                        <reference source="macos_security" ref_id="{}"/>
-                        <description>{}</description> 
-                    </metadata> 
-                <criteria> 
-                    <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                </criteria> 
-            </definition>
-            '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].rstrip().replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x)
-
-                            oval_test = oval_test + '''
-            <plist511_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="only_one_exists" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                <object object_ref="oval:mscp:obj:{}" />
-                <state state_ref="oval:mscp:ste:{}" />
-            </plist511_test>
-        '''.format(rule_yaml['id'] + "_" + odv_label,x,x,x)
-
-                            oval_object = oval_object + '''
-            <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" version="1" comment="find a username" id="oval:mscp:obj:{}">
-                <filepath>/Library/Preferences/com.apple.loginwindow.plist</filepath>
-                <xpath>/plist/dict/key[string()="lastUserName"]/following-sibling::*[1]/text()</xpath>
-            </plist511_object>
-            <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                <filepath datatype="string" operation="equals" var_check="at least one" var_ref="oval:mscp:var:{}"/>
-                <xpath>/plist/dict/key[string()="{}"]/following-sibling::*[1]/string[string()="{}"]/text()</xpath>
-            </plist511_object>  
-            '''.format(x+1999,rule_yaml['id'] + "_" + odv_label,x,x,key,str(value).strip('[]').strip("'"))
-                            
-                    
-                            oval_state = oval_state + '''
-        
-            <plist511_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-            <value_of datatype="string" operation="equals">{}</value_of>
-            </plist511_state>
-        
-            '''.format(rule_yaml['id'] + "_" + odv_label,x,str(value).strip('[]').strip("'"))
-
-                            oval_variable = oval_variable +           '''    
-            <local_variable id="oval:mscp:var:{}" version="1" datatype="string" comment="user managed pref">
-                <concat>
-                    <literal_component datatype="string">/Library/Managed Preferences/</literal_component>
-                    <object_component object_ref="oval:mscp:obj:{}" item_field="value_of"/>
-                    <literal_component datatype="string">/com.apple.systempreferences.plist</literal_component>
-                </concat>
-            </local_variable>'''.format(x,x+1999)
-                            x += 1
-                            continue
-                        
-                        state_kind = ""
-                        if type(value) == bool:
-                            state_kind = "boolean"
-                        elif type(value) == int:
-                            state_kind = "int"
-                        elif type(value) == str:
-                            state_kind = "string"
-                            try:
-                                int(value)
-                                state_kind = "int"
-                            except:
-                                pass
-
-                        elif type(value) == dict:
-                            state_kind = "string"
-                        else:
-                            
-                            continue
-                        
-                        oval_definition = oval_definition + '''
-                    <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                        <title>{}</title>
-                        <reference source="CCE" ref_id="{}"/>
-                        <reference source="macos_security" ref_id="{}"/>
-                        <description>{}</description> 
-                    </metadata> 
-                <criteria> 
-                    <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                </criteria> 
-            </definition>
-            '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].rstrip().replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x)
-
-                        oval_test = oval_test + '''
-            <plist511_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="only_one_exists" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                <object object_ref="oval:mscp:obj:{}" />
-                <state state_ref="oval:mscp:ste:{}" />
-            </plist511_test>
-        '''.format(rule_yaml['id'] + "_" + odv_label,x,x,x)
-                        
-                        oval_object = oval_object + '''
-            <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                <filepath>/Library/Managed Preferences/{}.plist</filepath>'''.format(rule_yaml['id'] + "_" + odv_label,x,payload_type)
-                        
-                        if state_kind == "boolean":
-                            oval_object = oval_object + '''
-                <xpath>name(//*[contains(text(), "{}")]/following-sibling::*[1])</xpath>
-            </plist511_object>'''.format(key)
-                        else:
-                            if payload_type == "com.apple.mobiledevice.passwordpolicy" and "customRegex" in info:
-                                oval_object = oval_object + '''
-                            <xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-            </plist511_object>'''.format("passwordContentRegex")
-                                oval_state = oval_state + '''
-                        <plist511_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-            <value_of datatype="{}" operation="equals">{}</value_of>
-            </plist511_state>
-            '''.format(rule_yaml['id'] + "_" + odv_label,x,state_kind,value['passwordContentRegex'])
-                                x += 1
-                                continue
-                            else:
-                                oval_object = oval_object + '''
-                                <xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-                </plist511_object>'''.format(key)
-                          
-                        oval_state = oval_state + '''
-                        <plist511_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-            <value_of datatype="{}" operation="equals">{}</value_of>
-            </plist511_state>
-            '''.format(rule_yaml['id'] + "_" + odv_label,x,state_kind,value)
-                        x += 1
-                        continue
             else:
-                command = rule_yaml['check'].split("/")
-                if "sntp" in rule_yaml['check']:
-                    print(rule_yaml['id'] + " - No relevant oval test")
-                    xccdf_rules = replace_ocil(xccdf_rules,x)
-                    x += 1
-                    continue
-                if "xprotect status" in rule_yaml['check']:
-                    print(rule_yaml['id'] + " - No relevant oval test")
-                    xccdf_rules = replace_ocil(xccdf_rules,x)
-                    x += 1
-                    continue
-                if "SPStorageDataType" in rule_yaml['check']:
-                    
-                    print(rule_yaml['id'] + " - No relevant oval test")
-                    xccdf_rules = replace_ocil(xccdf_rules,x)
-                    x += 1
-                    continue
-                try:
-                    if "fdesetup" in command[3]:
-                        
-                        print(rule_yaml['id'] + " - No relevant oval test")
-                        xccdf_rules = replace_ocil(xccdf_rules,x)
-                        x += 1
-                        continue
-                except:
-                    pass
-                try:
-                    if "profiles" in command[3]:
-                        if "/usr/bin/profiles status -type enrollment" in rule_yaml['check']:
-                            oval_definition = oval_definition  + '''
-                            <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                            <title>{}</title>
-                            <reference source="CCE" ref_id="{}"/>
-                            <reference source="macos_security" ref_id="{}"/>
-                            <description>{}</description> 
-                        </metadata> 
-                    <criteria operator="OR">
-                        <criterion comment="com.apple.extensiblesso" test_ref="oval:mscp:tst:{}" />
-                        <criterion comment="com.apple.syspolicy.kernel-extension-policy" test_ref="oval:mscp:tst:{}" />
-                        <criterion comment="com.apple.TCC.configuration-profile-policy" test_ref="oval:mscp:tst:{}" />
-                    </criteria> 
-                </definition>'''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].replace("&","&amp;"),x,x+899,x+799)
+                check_result = str()
+                for k,v in rule_yaml['result'].items():
+                    check_result = v
+                count_found = False
 
-                            oval_test = oval_test + '''
-                                <file_test id="oval:mscp:tst:{}" version="1" comment="com.apple.extensiblesso_test" check_existence="all_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix">
-                    <object object_ref="oval:mscp:obj:{}"/>
-                </file_test>
-                <file_test id="oval:mscp:tst:{}" version="1" comment="com.apple.syspolicy.kernel-extension-policy_test" check_existence="all_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix">
-                    <object object_ref="oval:mscp:obj:{}"/>
-                </file_test>
-                <file_test id="oval:mscp:tst:{}" version="1" comment="com.apple.TCC.configuration-profile-policy_test" check_existence="all_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix">
-                    <object object_ref="oval:mscp:obj:{}"/>
-                </file_test>'''.format(x,x,x+899,x+899,x+799,x+799)
+                if " 2> /dev/null" in rule_yaml['check']:
+                    rule_yaml['check'] = rule_yaml['check'].replace(" 2> /dev/null","")
 
-                            oval_object = oval_object + '''
-                            <file_object id="oval:mscp:obj:{}" version="1" comment="com.apple.extensiblesso_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix">
-                    <filepath operation="equals">/Library/Managed Preferences/com.apple.extensiblesso.plist</filepath>
-                </file_object>
-                <file_object id="oval:mscp:obj:{}" version="1" comment="com.apple.syspolicy.kernel-extension-policy_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix">
-                    <filepath operation="equals">/Library/Managed Preferences/com.apple.syspolicy.kernel-extension-policy.plist</filepath>
-                </file_object>
-                <file_object id="oval:mscp:obj:{}" version="1" comment="com.apple.syspolicy.kernel-extension-policy_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix">
-                    <filepath operation="equals">/Library/Managed Preferences/com.apple.TCC.configuration-profile-policy.plist</filepath>
-                </file_object> '''.format(x,x+899,x+799)
-                        x += 1
-                        continue
-                except:
-                    pass
-                try:
-                    if "csrutil" in command[3]:
-                        if "authenticated-root" in command[3]:
-                            
-                            print(rule_yaml['id'] + " - No relevant oval test")
-                            xccdf_rules = replace_ocil(xccdf_rules,x)
-                            x += 1
-                            continue
-                        oval_definition = oval_definition + '''
-                        <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                        <metadata> 
-                            <title>{}</title> 
-                            <reference source="CCE" ref_id="{}"/>
-                            <reference source="macos_security" ref_id="{}"/>
-                            <description>{}</description> 
-                        </metadata> 
-                    <criteria>
-                        <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                    </criteria>
-                </definition>
-                '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x)
-
-                        oval_test = oval_test + '''
-                            <systemprofiler_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="only_one_exists" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                    <object object_ref="oval:mscp:obj:{}" />
-                    <state state_ref="oval:mscp:ste:{}" />
-                </systemprofiler_test>
-                '''.format(rule_yaml['id'] + "_" + odv_label,x,x,x)
-
-                        oval_object = oval_object + '''
-                    <systemprofiler_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                <data_type>SPSoftwareDataType</data_type>
-
-        <xpath>//*[contains(text(), "system_integrity")]/following-sibling::string[position()=1]/text()</xpath>
-                </systemprofiler_object>
-                '''.format(rule_yaml['id'] + "_" + odv_label,x)
-
-                        oval_state = oval_state + '''
-                                <systemprofiler_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-                    <data_type>SPSoftwareDataType</data_type>
-
-        <xpath>//*[contains(text(), "system_integrity")]/following-sibling::string[position()=1]/text()</xpath>
-        <value_of>integrity_enabled</value_of>
-                </systemprofiler_state>
-                '''.format(rule_yaml['id'] + "_" + odv_label,x)
-                        x += 1
-                        continue
-                except:
-                    pass
-                if "pfctl" in rule_yaml['check']:
-                    print(rule_yaml['id'] + " - No relevant oval test")
-                    xccdf_rules = replace_ocil(xccdf_rules,x)
-                    x += 1
-                    continue
-                if "dump-keychain" in rule_yaml['check']:
-                    print(rule_yaml['id'] + " - No relevant oval test")
-                    xccdf_rules = replace_ocil(xccdf_rules,x)
-                    x += 1
-                    continue
-                try:
-                    if "mdmclient" in command[3]:
-                        print(rule_yaml['id'] + " - No relevant oval test")
-                        xccdf_rules = replace_ocil(xccdf_rules,x)
-                        x += 1
-                        continue
-                except:
-                    pass
-                try:
-                    if "nvram" in command[3]:
-                        print(rule_yaml['id'] + " - No relevant oval test")
-                        xccdf_rules = replace_ocil(xccdf_rules,x)
-                        x += 1
-                        continue
-                except:
-                    pass
-
-                try:
-                    if "pmset" in command[3] and "standby" in rule_yaml['check']:
-                        oval_definition = oval_definition + '''
-                            <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                        <metadata> 
-                            <title>{}</title> 
-                            <reference source="CCE" ref_id="{}"/>
-                            <reference source="macos_security" ref_id="{}"/>
-                            <description>{}</description> 
-                        </metadata> 
-                    <criteria>
-                        <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                        <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                        <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                    </criteria>
-                </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].replace("&","&amp;"),rule_yaml['id'] +"_standbydelayhigh",x, rule_yaml['id'] +"_standbydelaylow",x+877, rule_yaml['id'] +"_highstandbythreshold",x+888)
-                        
-                        
-                        oval_test = oval_test + '''
-                <plist511_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="at_least_one_exists" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                    <object object_ref="oval:mscp:obj:{}" />
-                    <state state_ref="oval:mscp:ste:{}" />
-                </plist511_test>'''.format(rule_yaml['id'] + "_standbydelayhigh",x,x,x)
-
-                        oval_test = oval_test + '''
-                <plist511_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="at_least_one_exists" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                    <object object_ref="oval:mscp:obj:{}" />
-                    <state state_ref="oval:mscp:ste:{}" />
-                </plist511_test>'''.format(rule_yaml['id'] + "_standbydelaylow",x+877,x+877,x+877)
-                        
-                        oval_test = oval_test + '''
-                <plist511_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="at_least_one_exists" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                    <object object_ref="oval:mscp:obj:{}" />
-                    <state state_ref="oval:mscp:ste:{}" />
-                </plist511_test>'''.format(rule_yaml['id'] + "_highstandbythreshold",x+888,x+888,x+888)
-
-                        
-                        standbydelayhigh = str()
-                        standbydelaylow = str()
-                        highstandbythreshold = str()
-
-                        for line in rule_yaml['fix'].split("----")[1].split("\n"):
-                            if line == "":
-                                continue
-                            if "standbydelayhigh" in line:
-                                standbydelayhigh = line.split(" ")[-1].rstrip()
-                            if "standbydelaylow" in line:
-                                standbydelaylow = line.split(" ")[-1].rstrip()
-                            if "highstandbythreshold" in line:
-                                highstandbythreshold = line.split(" ")[-1].rstrip()
-                            
-                        oval_object = oval_object + '''
-                                        <systemprofiler_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}" id="oval:mscp:obj:{}" version="1">
-                <data_type>SPHardwareDataType</data_type>
-
-                    <xpath>//*[contains(text(), "platform_UUID")]/following-sibling::string[position()=1]/text()</xpath>
-                </systemprofiler_object> '''.format("hardware UUID",x+999)
-
-                        oval_variable = oval_variable + '''       
-            <local_variable id="oval:mscp:var:{}" version="1" datatype="string" comment="uuid variable">
-                <concat>
-                    <literal_component datatype="string">/Library/Preferences/com.apple.PowerManagement.</literal_component>
-                    <object_component object_ref="oval:mscp:obj:{}" item_field="value_of"/>
-                    <literal_component datatype="string">.plist</literal_component>
-                </concat>
-            </local_variable>'''.format(x,x+999)
-
-                        oval_object = oval_object + '''
-                <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                    <filepath datatype="string" operation="equals" var_check="at least one" var_ref="oval:mscp:var:{}"/>'''.format(rule_yaml['id'] + "_standbydelayhigh",x,x)
-                
-                        oval_object = oval_object + '''
-                    <xpath>boolean(plist/dict[key="AC Power"]/dict[key="{}"]/integer/text() = "{}")</xpath>
-                </plist511_object>'''.format("High Standby Delay",standbydelayhigh)
-                    
-
-                        oval_object = oval_object + '''
-                <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                    <filepath datatype="string" operation="equals" var_check="at least one" var_ref="oval:mscp:var:{}"/>'''.format(rule_yaml['id'] + "_standbydelaylow",x+877, x)
-                
-                        oval_object = oval_object + '''
-                    <xpath>boolean(plist/dict[key="AC Power"]/dict[key="{}"]/integer/text() = "{}")</xpath>
-                </plist511_object>'''.format("Standby Delay",standbydelaylow)
-
-                        oval_object = oval_object + '''
-                <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                    <filepath datatype="string" operation="equals" var_check="at least one" var_ref="oval:mscp:var:{}"/>'''.format(rule_yaml['id'] + "_highstandbythreshold",x+888, x)
-                        
-                        oval_object = oval_object + '''
-                    <xpath>boolean(plist/dict[key="AC Power"]/dict[key="{}"]/integer/text() = "{}")</xpath>
-                </plist511_object>'''.format("Standby Battery Threshold",highstandbythreshold)
-                        
-                        oval_state = oval_state + '''
-                            <plist511_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-                <value_of datatype="boolean" operation="equals">true</value_of>
-                </plist511_state>'''.format(rule_yaml['id'] + "_standbydelayhigh",x)
-
-                        oval_state = oval_state + '''
-                            <plist511_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-                <value_of datatype="boolean" operation="equals">true</value_of>
-                </plist511_state>'''.format(rule_yaml['id'] + "_standbydelaylow",x+877)
-
-                        oval_state = oval_state + '''
-                            <plist511_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-                <value_of datatype="boolean" operation="equals">true</value_of>
-                </plist511_state>'''.format(rule_yaml['id'] + "_highstandbythreshold",x+888)
-
-                        x += 1
-                        continue
-                except:
-                    pass
-                if "sudo -V" in rule_yaml['check']:
-                    
-                    
-                    if "grep" in rule_yaml['check'].split("|")[1]:
-                        oval_definition = oval_definition + '''
-                        <definition id="oval:mscp:def:{0}" version="1" class="compliance"> 
-                    <metadata> 
-                        <title>{1}</title> 
-                        <reference source="CCE" ref_id="{2}"/>
-                        <reference source="macos_security" ref_id="{3}"/>
-                        <description>{4}</description> 
-                    </metadata> 
-                <criteria operator="OR">
-                    <criterion comment="{5}" test_ref="oval:mscp:tst:{6}" />
-                    <criterion comment="{7}_sudoers.d" test_ref="oval:mscp:tst:{8}"/>
-                </criteria>
-            </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x,rule_yaml['id'] + "_" + odv_label, x+5051)
-                    
-                        oval_test = oval_test + '''
-                <textfilecontent54_test id="oval:mscp:tst:{}" version="1" comment="{}_test" check_existence="all_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-            <object object_ref="oval:mscp:obj:{}"/>
-        </textfilecontent54_test>
-        '''.format(x, rule_yaml['id'] + "_" + odv_label, x)
-                    
-                        oval_test = oval_test + '''
-                <textfilecontent54_test id="oval:mscp:tst:{}" version="1" comment="{}_sudoers.d_test" check_existence="all_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-            <object object_ref="oval:mscp:obj:{}"/>
-        </textfilecontent54_test>
-        '''.format(x+5051, rule_yaml['id'] + "_" + odv_label, x+5051)
-
-                        check_string = rule_yaml['fix'].split("echo")[1].split('"')[1]
-                        
-                        oval_object = oval_object + '''
-                    <textfilecontent54_object id="oval:mscp:obj:{}" version="1" comment="{}_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                    <behaviors ignore_case="true"/>
-                    <filepath>/etc/sudoers</filepath>
-                    <pattern operation="pattern match">{}</pattern>
-                    <instance datatype="int">1</instance>
-                </textfilecontent54_object>'''.format(x, rule_yaml['id'] + "_" + odv_label, check_string)
+                check_existance = "all_exist"
 
 
-                        oval_object = oval_object + '''
-                <textfilecontent54_object id="oval:mscp:obj:{}" version="1" comment="{}__sudoers.d_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                <behaviors ignore_case="true"/>
-                <path>/etc/sudoers.d/</path>
-                <filename operation="pattern match">.*</filename>
-                <pattern operation="pattern match">{}</pattern>
-                <instance datatype="int">1</instance>
-            </textfilecontent54_object>'''.format(x+5051, rule_yaml['id'] + "_" + odv_label, check_string)
-                    
-                
-                        x = x + 1
-                        continue
-
-                    if "awk" in rule_yaml['check'].split("|")[1]:
-                        if "timestamp_type" in rule_yaml['fix'] and rule_yaml['result']['string'] == "tty":
-                            oval_definition = oval_definition + '''
-                        <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                        <title>{}</title> 
-                        <reference source="CCE" ref_id="{}"/>
-                        <reference source="macos_security" ref_id="{}"/>
-                        <description>{}</description> 
-                    </metadata> 
-                <criteria operator="AND">
-                    <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                    <criterion comment="{}_sudoers.d" test_ref="oval:mscp:tst:{}"/>
-                    <criterion comment="{}_tty_ticket" test_ref="oval:mscp:tst:{}" />
-                    <criterion comment="{}_sudoers.d_tty_ticket" test_ref="oval:mscp:tst:{}"/>
-                </criteria>
-            </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x,rule_yaml['id'] + "_" + odv_label, x+8000, rule_yaml['id'] + "_" + odv_label,x+8001, rule_yaml['id'] + "_" + odv_label,x+8002,rule_yaml['id'] + "_" + odv_label,x+8003)
-                    
-                            oval_test = oval_test + '''
-                    <textfilecontent54_test id="oval:mscp:tst:{}" version="1" comment="{}_test" check_existence="none_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                <object object_ref="oval:mscp:obj:{}"/>
-            </textfilecontent54_test>
-            '''.format(x, rule_yaml['id'] + "_" + odv_label, x)
-                        
-                            oval_test = oval_test + '''
-                    <textfilecontent54_test id="oval:mscp:tst:{}" version="1" comment="{}_sudoers.d_test" check_existence="none_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                <object object_ref="oval:mscp:obj:{}"/>
-            </textfilecontent54_test>
-            '''.format(x+8000, rule_yaml['id'] + "_" + odv_label, x+8000)
-
-                            oval_test = oval_test + '''
-                    <textfilecontent54_test id="oval:mscp:tst:{}" version="1" comment="{}_sudoers.d_test" check_existence="none_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                <object object_ref="oval:mscp:obj:{}"/>
-            </textfilecontent54_test>
-            '''.format(x+8001, rule_yaml['id'] + "_" + odv_label, x+8001)
-
-                            oval_test = oval_test + '''
-                    <textfilecontent54_test id="oval:mscp:tst:{}" version="1" comment="{}_sudoers.d_test" check_existence="none_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                <object object_ref="oval:mscp:obj:{}"/>
-            </textfilecontent54_test>
-            '''.format(x+8002, rule_yaml['id'] + "_" + odv_label, x+8002)
-
-                            
-                            oval_object = oval_object + '''
-                        <textfilecontent54_object id="oval:mscp:obj:{}" version="1" comment="{}_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                        <behaviors ignore_case="true"/>
-                        <filepath>/etc/sudoers</filepath>
-                        <pattern operation="pattern match">timestamp_type</pattern>
-                        <instance datatype="int">1</instance>
-                    </textfilecontent54_object>'''.format(x, rule_yaml['id'] + "_" + odv_label)
-
-
-                            oval_object = oval_object + '''
-                    <textfilecontent54_object id="oval:mscp:obj:{}" version="1" comment="{}__sudoers.d_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                    <behaviors ignore_case="true"/>
-                    <path>/etc/sudoers.d/</path>
-                    <filename operation="pattern match">.*</filename>
-                    <pattern operation="pattern match">timestamp_type</pattern>
-                    <instance datatype="int">1</instance>
-                </textfilecontent54_object>'''.format(x+8000, rule_yaml['id'] + "_" + odv_label)
-
-                            oval_object = oval_object + '''
-                    <textfilecontent54_object id="oval:mscp:obj:{}" version="1" comment="{}__sudoers.d_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                    <behaviors ignore_case="true"/>
-                    <path>/etc/sudoers.d/</path>
-                    <filename operation="pattern match">.*</filename>
-                    <pattern operation="pattern match">!tty_tickets</pattern>
-                    <instance datatype="int">1</instance>
-                </textfilecontent54_object>'''.format(x+8001, rule_yaml['id'] + "_" + odv_label)
-                            oval_object = oval_object + '''
-                    <textfilecontent54_object id="oval:mscp:obj:{}" version="1" comment="{}__sudoers.d_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                    <behaviors ignore_case="true"/>
-                    <path>/etc/sudoers.d/</path>
-                    <filename operation="pattern match">.*</filename>
-                    <pattern operation="pattern match">!tty_tickets</pattern>
-                    <instance datatype="int">1</instance>
-                </textfilecontent54_object>'''.format(x+8002, rule_yaml['id'] + "_" + odv_label)
-                            x = x + 1
-                            continue
-                        else:
-                            check_string = "Defaults.*.timestamp_type={}".format(rule_yaml['result']['string'])
-                            
-                            oval_definition = oval_definition + '''
-                        <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                        <title>{}</title> 
-                        <reference source="CCE" ref_id="{}"/>
-                        <reference source="macos_security" ref_id="{}"/>
-                        <description>{}</description> 
-                    </metadata> 
-                <criteria operator="OR">
-                    <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                    <criterion comment="{}_sudoers.d" test_ref="oval:mscp:tst:{}"/>
-                </criteria>
-            </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x,rule_yaml['id'] + "_" + odv_label, x+8000, rule_yaml['id'] + "_" + odv_label,x+8001, rule_yaml['id'] + "_" + odv_label,x+8002,rule_yaml['id'] + "_" + odv_label,x+8003)
-                    
-                            oval_test = oval_test + '''
-                    <textfilecontent54_test id="oval:mscp:tst:{}" version="1" comment="{}_test" check_existence="at_least_one_exists" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                <object object_ref="oval:mscp:obj:{}"/>
-            </textfilecontent54_test>
-            '''.format(x, rule_yaml['id'] + "_" + odv_label, x)
-                        
-                            oval_test = oval_test + '''
-                    <textfilecontent54_test id="oval:mscp:tst:{}" version="1" comment="{}_sudoers.d_test" check_existence="at_least_one_exists" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                <object object_ref="oval:mscp:obj:{}"/>
-            </textfilecontent54_test>
-            '''.format(x+5000, rule_yaml['id'] + "_" + odv_label, x+7000)
-
-                            oval_object = oval_object + '''
-                        <textfilecontent54_object id="oval:mscp:obj:{}" version="1" comment="{}_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                        <behaviors ignore_case="true"/>
-                        <filepath>/etc/sudoers</filepath>
-                        <pattern operation="pattern match">{}</pattern>
-                        <instance datatype="int">1</instance>
-                    </textfilecontent54_object>'''.format(x, rule_yaml['id'] + "_" + odv_label, check_string)
-
-                        
-                            oval_object = oval_object + '''
-                    <textfilecontent54_object id="oval:mscp:obj:{}" version="1" comment="{}__sudoers.d_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                    <behaviors ignore_case="true"/>
-                    <path>/etc/sudoers.d/</path>
-                    <filename operation="pattern match">.*</filename>
-                    <pattern operation="pattern match">{}</pattern>
-                    <instance datatype="int">1</instance>
-                </textfilecontent54_object>'''.format(x+7000, rule_yaml['id'] + "_" + odv_label, check_string)
-
-                        x = x + 1
-                        continue
-
-                if "ssh_config" in rule_yaml['discussion'] and "dscl" in rule_yaml['check']:
-                    oval_definition = oval_definition + '''
-                        <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                        <title>{}</title> 
-                        <reference source="CCE" ref_id="{}"/>
-                        <reference source="macos_security" ref_id="{}"/>
-                        <description>{}</description> 
-                    </metadata> 
-                <criteria operator="OR">
-                    <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                    <criterion comment="{}_ssh_config.d" test_ref="oval:mscp:tst:{}"/>
-                    <criterion comment="{}_.ssh" test_ref="oval:mscp:tst:{}"/>
-                </criteria>
-            </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x,rule_yaml['id'] + "_" + odv_label, x+5010, rule_yaml['id'] + "_" + odv_label,x+5025)
-                    
-                    oval_test = oval_test + '''
-                <textfilecontent54_test id="oval:mscp:tst:{}" version="1" comment="{}_test" check_existence="all_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-            <object object_ref="oval:mscp:obj:{}"/>
-        </textfilecontent54_test>
-        '''.format(x, rule_yaml['id'] + "_" + odv_label, x)
-                    
-                    oval_test = oval_test + '''
-                <textfilecontent54_test id="oval:mscp:tst:{}" version="1" comment="{}_ssh_config.d_test" check_existence="all_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-            <object object_ref="oval:mscp:obj:{}"/>
-        </textfilecontent54_test>
-        '''.format(x+5010, rule_yaml['id'] + "_" + odv_label, x+5010)
-                    oval_test = oval_test + '''
-                <textfilecontent54_test id="oval:mscp:tst:{}" version="1" comment="{}_ssh_config.d_test" check_existence="all_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-            <object object_ref="oval:mscp:obj:{}"/>
-        </textfilecontent54_test>
-        '''.format(x+5025, rule_yaml['id'] + "_" + odv_label, x+5025)
-                    regex = r"(?<=grep).*$"
-                    matches = re.finditer(regex, rule_yaml['check'], re.MULTILINE)
-                    matchy_match = ""
-                    for matchNum, match in enumerate(matches, start=1):
-                        matchy_match = match.group()
+                if "/usr/bin/grep -c" in rule_yaml['check']:
+                    if "echo \"1\"" not in rule_yaml['check'] or "echo \"0\"" not in rule_yaml['check']:
+                        if "/usr/bin/ssh -G ." not in rule_yaml['check']:
+                            if "auditd_enabled" not in rule_yaml['id']:
+                                if "/usr/sbin/sshd -G" not in rule_yaml['check']:
                                 
-                    ssh_config_pattern = matchy_match.split('"')[1]
+                                    rule_yaml['check'] = rule_yaml['check'].replace("/usr/bin/grep -c ", "/usr/bin/grep ")
+                                    count_found = True
+                                    if check_result == 0:                        
+                                        check_existance = "none_exist"
                     
-
-                    oval_object = oval_object + '''
-                <textfilecontent54_object id="oval:mscp:obj:{}" version="1" comment="{}_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                <behaviors ignore_case="true"/>
-                <filepath>/etc/ssh/ssh_config</filepath>
-                <pattern operation="pattern match">{}</pattern>
-                <instance datatype="int">1</instance>
-            </textfilecontent54_object>'''.format(x, rule_yaml['id'] + "_" + odv_label, ssh_config_pattern)
-
-
-                    oval_object = oval_object + '''
-                <textfilecontent54_object id="oval:mscp:obj:{}" version="1" comment="{}__ssh_config.d_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                <behaviors ignore_case="true"/>
-                <path>/etc/ssh/ssh_config.d/</path>
-                <filename operation="pattern match">.*</filename>
-                <pattern operation="pattern match">{}</pattern>
-                <instance datatype="int">1</instance>
-            </textfilecontent54_object>'''.format(x+5010, rule_yaml['id'] + "_" + odv_label, ssh_config_pattern)
-                    
-                    oval_object = oval_object + '''
-            <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mscp:obj:{}" version="1" comment="{}_.ssh_object" >
-            <filepath var_ref="oval:mscp:var:{}"></filepath>
-            <pattern operation="pattern match">{}</pattern>
-            <instance datatype="int">1</instance>
-            
-            </textfilecontent54_object>
-            
-
-            <accountinfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="user home directory" id="oval:mscp:obj:{}" version="1">
-                <username operation="pattern match">.*</username>
-                <filter action="include" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5">oval:mscp:ste:{}</filter>
-            </accountinfo_object>'''.format(x+5025,rule_yaml['id'] + "_" + odv_label,x,ssh_config_pattern,x+999,x+999)
-                
-                    oval_state = oval_state + '''
-                       <accountinfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="accountinfo_state" id="oval:mscp:ste:{}" version="1">
-                <username operation="pattern match">^[^_\s].*</username>
-                <uid datatype="int" operation="not equal">0</uid>
-                <gid datatype="int" operation="not equal">0</gid>
-                <login_shell operation="not equal">/usr/bin/false</login_shell>
-            </accountinfo_state>'''.format(x+999)
-
-                    oval_variable = oval_variable + '''
-                    <local_variable id="oval:mscp:var:{}" version="1" datatype="string" comment="home directory variable">
-                <concat>
-                <object_component object_ref="oval:mscp:obj:{}" item_field="home_dir"/>
-                <literal_component datatype="string">/.ssh/config</literal_component>
-                </concat>
-        </local_variable>'''.format(x,x+999)
-                    x = x + 1
-                    continue
-                if "sshd -T" in rule_yaml['check'] and "fips" in rule_yaml['check'] or "sshd -G" in rule_yaml['check'] and "fips" in rule_yaml['check']:
-                    fipslist = rule_yaml['check'].split("\n")[0].split("(")[1].replace(")","").replace('" "',"\n").replace('"',"")
-                    
-                    
-                    oval_definition = oval_definition + '''
-                        <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                        <title>{}</title> 
-                        <reference source="CCE" ref_id="{}"/>
-                        <reference source="macos_security" ref_id="{}"/>
-                        <description>{}</description> 
-                    </metadata> 
-                <criteria operator="OR">
-                    <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                    <criterion comment="{}_sshd_config.d" test_ref="oval:mscp:tst:{}"/>
-                </criteria>
-            </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x,rule_yaml['id'] + "_" + odv_label, x+6000, rule_yaml['id'] + "_" + odv_label,x+6001)
-                    
-                    oval_test = oval_test + '''
-                <textfilecontent54_test id="oval:mscp:tst:{}" version="1" comment="{}_test" check_existence="all_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-            <object object_ref="oval:mscp:obj:{}"/>
-        </textfilecontent54_test>
-        '''.format(x, rule_yaml['id'] + "_" + odv_label, x)
-                    
-                    oval_test = oval_test + '''
-                <textfilecontent54_test id="oval:mscp:tst:{}" version="1" comment="{}_sshd_config.d_test" check_existence="all_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-            <object object_ref="oval:mscp:obj:{}"/>
-        </textfilecontent54_test>
-        '''.format(x+6000, rule_yaml['id'] + "_" + odv_label, x+6000)
-                    
-                    oval_object = oval_object + '''
-                <textfilecontent54_object id="oval:mscp:obj:{}" version="1" comment="{}_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                <behaviors ignore_case="true"/>
-                <filepath>/etc/ssh/sshd_config</filepath>
-                <pattern operation="pattern match">{}</pattern>
-                <instance datatype="int">1</instance>
-            </textfilecontent54_object>'''.format(x, rule_yaml['id'] + "_" + odv_label, fipslist)
-
-
-                    oval_object = oval_object + '''
-                <textfilecontent54_object id="oval:mscp:obj:{}" version="1" comment="{}__sshd_config.d_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                <behaviors ignore_case="true"/>
-                <path>/etc/ssh/sshd_config.d/</path>
-                <filename operation="pattern match">.*</filename>
-                <pattern operation="pattern match">{}</pattern>
-                <instance datatype="int">1</instance>
-            </textfilecontent54_object>'''.format(x+6000, rule_yaml['id'] + "_" + odv_label, fipslist)
-                    
-                    x = x + 1
-                    
-                    continue
-                if "sshd -T" in rule_yaml['check'] or "sshd -G" in rule_yaml['check']:
-                    oval_definition = oval_definition + '''
-                        <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                        <title>{}</title> 
-                        <reference source="CCE" ref_id="{}"/>
-                        <reference source="macos_security" ref_id="{}"/>
-                        <description>{}</description> 
-                    </metadata> 
-                <criteria operator="OR">
-                    <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                    <criterion comment="{}_sshd_config.d" test_ref="oval:mscp:tst:{}"/>
-                </criteria>
-            </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x,rule_yaml['id'] + "_" + odv_label, x+6000, rule_yaml['id'] + "_" + odv_label,x+6001)
-                    
-                    oval_test = oval_test + '''
-                <textfilecontent54_test id="oval:mscp:tst:{}" version="1" comment="{}_test" check_existence="all_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-            <object object_ref="oval:mscp:obj:{}"/>
-        </textfilecontent54_test>
-        '''.format(x, rule_yaml['id'] + "_" + odv_label, x)
-                    
-                    oval_test = oval_test + '''
-                <textfilecontent54_test id="oval:mscp:tst:{}" version="1" comment="{}_sshd_config.d_test" check_existence="all_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-            <object object_ref="oval:mscp:obj:{}"/>
-        </textfilecontent54_test>
-        '''.format(x+6000, rule_yaml['id'] + "_" + odv_label, x+6000)
-                    sshd_config_pattern = ""
-                    if "grep" in rule_yaml['check']:                        
-                        regex = r"(?<=grep).*$"
-                        matches = re.finditer(regex, rule_yaml['check'], re.MULTILINE)
-                        matchy_match = ""
-                        for matchNum, match in enumerate(matches, start=1):
-                            matchy_match = match.group()
-                        sshd_config_pattern = ""
-                        if '"' in matchy_match:
-                            sshd_config_pattern = matchy_match.split('"')[1]
-                        elif "'" in matchy_match:
-                            sshd_config_pattern = matchy_match.split("'")[1]
-                    
-                    if "awk" in rule_yaml['check']:
-                        matchy_match = rule_yaml['check'].split("'")[1].split("/")[1]
-                        for item in rule_yaml['result']:
-                            sshd_config_pattern = matchy_match + " " + str(rule_yaml['result'][item])
-                    
-                    oval_object = oval_object + '''
-                <textfilecontent54_object id="oval:mscp:obj:{}" version="1" comment="{}_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                <behaviors ignore_case="true"/>
-                <filepath>/etc/ssh/sshd_config</filepath>
-                <pattern operation="pattern match">{}</pattern>
-                <instance datatype="int">1</instance>
-            </textfilecontent54_object>'''.format(x, rule_yaml['id'] + "_" + odv_label, sshd_config_pattern)
-
-
-                    oval_object = oval_object + '''
-                <textfilecontent54_object id="oval:mscp:obj:{}" version="1" comment="{}__sshd_config.d_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                <behaviors ignore_case="true"/>
-                <path>/etc/ssh/sshd_config.d/</path>
-                <filename operation="pattern match">.*</filename>
-                <pattern operation="pattern match">{}</pattern>
-                <instance datatype="int">1</instance>
-            </textfilecontent54_object>'''.format(x+6000, rule_yaml['id'] + "_" + odv_label, sshd_config_pattern)
-                    
-                
-                    x = x + 1
-                    continue
-                try:
-                    if "pmset" in command[3]:
-                        oval_definition = oval_definition + '''
-                            <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                        <metadata> 
-                            <title>{}</title> 
-                            <reference source="CCE" ref_id="{}"/>
-                            <reference source="macos_security" ref_id="{}"/>
-                            <description>{}</description> 
-                        </metadata> 
-                    <criteria>
-                        <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-
-                    </criteria>
-                </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x)
-                        
-                        oval_test = oval_test + '''
-                <plist511_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="at_least_one_exists" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                    <object object_ref="oval:mscp:obj:{}" />
-                    <state state_ref="oval:mscp:ste:{}" />
-                </plist511_test>'''.format(rule_yaml['id'] + "_" + odv_label,x,x,x)
-                        
-                        oval_object = oval_object + '''
-                <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                    <filepath>/Library/Preferences/com.apple.PowerManagement.plist</filepath>'''.format(rule_yaml['id'] + "_" + odv_label,x)
-                        pmset_key = str()
-                        if "powernap" in rule_yaml['check']:
-                            pmset_key = "DarkWakeBackgroundTasks"
-                        if "womp" in rule_yaml['check']:
-                            pmset_key = "Wake On LAN"
-
-                        oval_object = oval_object + '''
-                    <xpath>boolean(plist/dict[key="AC Power"]/dict[key="{}"]/integer/text() = "{}")</xpath>
-                </plist511_object>'''.format(pmset_key,rule_yaml['fix'].split("----")[1].replace("\n","")[-1])
-
-                        oval_state = oval_state + '''
-                            <plist511_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-                <value_of datatype="boolean" operation="equals">true</value_of>
-                </plist511_state>'''.format(rule_yaml['id'] + "_" + odv_label,x)
-                        x += 1
-                        continue
-                except:
-                    pass
-                if "socketfilterfw" in rule_yaml['check']:
-                    oval_definition = oval_definition + '''
-            <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                        <title>{}</title> 
-                        <reference source="CCE" ref_id="{}"/>
-                        <reference source="macos_security" ref_id="{}"/>
-                        <description>{}</description> 
-                    </metadata> 
-                <criteria>
-                    <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-
-                </criteria>
-            </definition>
-            '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x)
-                    oval_test = oval_test + '''
-            <plist511_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="only_one_exists" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                <object object_ref="oval:mscp:obj:{}" />
-                <state state_ref="oval:mscp:ste:{}" />
-            </plist511_test>
-            '''.format(rule_yaml['id'] + "_" + odv_label,x,x,x)
-
-                    if rule_yaml['check'].split()[1] == "--getloggingmode":
-                        firewall_variable = "loggingenabled"
-                    elif rule_yaml['check'].split()[1] == "--getstealthmode":
-                        firewall_variable = "stealthenabled"
-                    elif rule_yaml['check'].split()[1] == "--getglobalstate":
-                        firewall_variable = "globalstate"
-
-                    oval_object = oval_object + '''
-                <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                <filepath>/Library/Preferences/com.apple.alf.plist</filepath>
-                <xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-            </plist511_object>'''.format(rule_yaml['id'] + "_" + odv_label,x,firewall_variable)
-
-                    oval_state = oval_state + '''
-            <plist511_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-            <value_of datatype="int" operation="equals">1</value_of>
-            </plist511_state>'''.format(rule_yaml['id'] + "_" + odv_label,x)
-                    x += 1
-                    continue
-                try:
-                    if "systemsetup" in command[3]:
-                        oval_definition = oval_definition + '''
-                            <definitions>
-                    <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                        <metadata> 
-                            <title>{}</title> 
-                            <reference source="CCE" ref_id="{}"/>
-                            <reference source="macos_security" ref_id="{}"/>
-                            <description>{}</description> 
-                        </metadata> 
-                    <criteria>
-                        <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-
-                    </criteria>
-                </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x)
-
-                        oval_test = oval_test + '''
-                        <systemsetup_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="only_one_exists" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                    <object object_ref="oval:mscp:obj:{}" />
-                    <state state_ref="oval:mscp:ste:{}" />
-                </systemsetup_test>'''.format(rule_yaml['id'] + "_" + odv_label,x,x,x)
-
-                        oval_object = oval_object + '''
-                    <systemsetup_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                </systemsetup_object>'''.format(rule_yaml['id'] + "_" + odv_label,x)
-                        state_test = ""
-                        if "-getnetworktimeserver" in rule_yaml['check']:
-                            
-                                timeservers = rule_yaml['result']['string']
-                            
-                                state_test = '''
-                                <networktimeserver datatype="string" operation="equals">{}</networktimeserver>
-                                '''.format(timeservers)
-                        oval_state = oval_state + '''
-                            <systemsetup_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-                {}
-                </systemsetup_state>'''.format(rule_yaml['id'] + "_" + odv_label,x,state_test)
-
-
-                except:
-                    pass
-
-                abc = 0
-                if "defaults" in rule_yaml['check'] and "grep" in rule_yaml['check'] and "CURRENT_USER" in rule_yaml['check']:
-                    
-                    regex = r"(?<=\()(.*?)(?=\))"
-
-                    test_str = rule_yaml['check'].split("grep")[1]
-
-                    matches = re.finditer(regex, test_str, re.MULTILINE)
-                    matchy_match = ""
-                    for matchNum, match in enumerate(matches, start=1):
-                        matchy_match = match.group()
-                    
-                    
-                    oval_definition = oval_definition + '''
-                        <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                        <title>{}</title> 
-                        <reference source="CCE" ref_id="{}"/>
-                        <reference source="macos_security" ref_id="{}"/>
-                        <description>{}</description> 
-                    </metadata> 
-                <criteria>
-                    '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x)
-                    
-                    for multi_grep in matchy_match.split("|"):
-                        
-                        oval_definition = oval_definition + '''
-                        <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                        '''.format(rule_yaml['id']+"_"+str(abc),x)
-                        
-                        oval_test = oval_test + '''
-                        <plist511_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="any_exist" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                <object object_ref="oval:mscp:obj:{}" />
-                <state state_ref="oval:mscp:ste:{}" />
-            </plist511_test>'''.format(rule_yaml['id']+"_"+str(abc),x,x,x)
-
-                        key = matchy_match.split("|")[abc].split(" = ")[0].replace("\"","")
-                        value = matchy_match.split("|")[abc].split(" = ")[1].replace(";","")
-                        if "$CURRENT_USER" in rule_yaml['check']:
-                            
-
-                            oval_object = oval_object + '''
-                            <accountinfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="home directory" id="oval:mscp:obj:{}" version="1">
-                <username operation="pattern match">.*</username>
-                <filter action="include" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5">oval:mscp:ste:{}</filter>
-            </accountinfo_object>
-            '''.format(x+1999,x+1999)
-
-                            oval_state = oval_state + '''
-                        <accountinfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="home directory state" id="oval:mscp:ste:{}" version="1">
-                <username operation="pattern match">^[^_\s].*</username>
-                <uid datatype="int" operation="not equal">0</uid>
-                <gid datatype="int" operation="not equal">0</gid>
-                <login_shell operation="not equal">/usr/bin/false</login_shell>
-            </accountinfo_state>'''.format(x+1999)
-                            plist = rule_yaml['check'].split("read")[1].split()[0].replace(".plist","")
-
-                            
-
-                            oval_variable = oval_variable + '''
-        <local_variable id="oval:mscp:var:{}" version="1" datatype="string" comment="uuid variable">
-            <concat>
-                <object_component object_ref="oval:mscp:obj:{}" item_field="home_dir"/>
-                <literal_component datatype="string">/Library/Preferences/{}.</literal_component>                    
-                <literal_component datatype="string">plist</literal_component>
-            </concat>
-        </local_variable>'''.format(x,x+1999,plist)
-
-        
-                        oval_object = oval_object + '''
-                <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                <filepath datatype="string" operation="equals" var_check="at least one" var_ref="oval:mscp:var:{}"/>'''.format(rule_yaml['id']+"_"+str(abc),x,x)
-
-                        oval_datatype = ""
-                        try:
-                            int(value)
-                            
-                            oval_datatype = "int"     
-                            oval_object = oval_object + '''
-                            <xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-                            </plist511_object>'''.format(key)
-                        except:
-                            if value.lower() == "true" or value.lower == "false":
-                                oval_datatype = "boolean"
-                                oval_object = oval_object + '''
-                        <xpath>name(//*[contains(text(), "{}")]/following-sibling::*[1])</xpath>
-                    </plist511_object>'''.format(key)
-                            else:
-                                oval_datatype = "string"
-                                oval_object = oval_object + '''
-                            <xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-                            </plist511_object>'''.format(key)
-                        oval_state = oval_state + '''
-            <plist511_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-            <value_of datatype="{}" operation="equals">{}</value_of>
-            </plist511_state>'''.format(rule_yaml['id']+"_"+str(abc),x,oval_datatype,value)
-                        
-                        abc =+ 1
-                        x = x+1
-                    oval_definition = oval_definition + '''</criteria>
-            </definition>'''
-                    oval_definition = re.sub('(?=\n\[NOTE\])(?s)(.*)\=\n<', '<', oval_definition)
-                    
-                    x = x+1
-                    break
-
-                        
-                if "defaults" in rule_yaml['check']:
-                    
-                    if rule_yaml['id'] == "system_settings_hot_corners_secure" or rule_yaml['id'] == "sysprefs_hot_corners_secure":
-                        oval_definition = oval_definition + '''
-                        <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                        <title>{}</title> 
-                        <reference source="CCE" ref_id="{}"/>
-                        <reference source="macos_security" ref_id="{}"/>
-                        <description>{}</description> 
-                    </metadata> 
-                <criteria operator="AND">
-                    <criterion comment="{}_1" test_ref="oval:mscp:tst:{}" />
-                    <criterion comment="{}_2" test_ref="oval:mscp:tst:{}" />
-                    <criterion comment="{}_3" test_ref="oval:mscp:tst:{}" />
-                    <criterion comment="{}_4" test_ref="oval:mscp:tst:{}" />
-                </criteria>
-            </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x,rule_yaml['id'] + "_" + odv_label,x+5000,rule_yaml['id'] + "_" + odv_label,x+5001,rule_yaml['id'] + "_" + odv_label,x+5002)
-                    
-                        oval_test = oval_test + '''
-                        <plist511_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="all_exist" comment="{}_1_test" id="oval:mscp:tst:{}" version="2">
-                <object object_ref="oval:mscp:obj:{}" />
-                <state state_ref="oval:mscp:ste:{}" />
-            </plist511_test>'''.format(rule_yaml['id'] + "_" + odv_label,x,x,x)
-
-                        oval_test = oval_test + '''
-                        <plist511_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="all_exist" comment="{}_2_test" id="oval:mscp:tst:{}" version="2">
-                <object object_ref="oval:mscp:obj:{}" />
-                <state state_ref="oval:mscp:ste:{}" />
-            </plist511_test>'''.format(rule_yaml['id'] + "_" + odv_label,x+5000,x+5000,x+5000)
-
-                        oval_test = oval_test + '''
-                        <plist511_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="all_exist" comment="{}_3_test" id="oval:mscp:tst:{}" version="2">
-                <object object_ref="oval:mscp:obj:{}" />
-                <state state_ref="oval:mscp:ste:{}" />
-            </plist511_test>'''.format(rule_yaml['id'] + "_" + odv_label,x+5001,x+5001,x+5001)
-
-                        oval_test = oval_test + '''
-                        <plist511_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="all_exist" comment="{}_4_test" id="oval:mscp:tst:{}" version="2">
-                <object object_ref="oval:mscp:obj:{}" />
-                <state state_ref="oval:mscp:ste:{}" />
-            </plist511_test>'''.format(rule_yaml['id'] + "_" + odv_label,x+5002,x+5002,x+5002)
-
-                        plist = rule_yaml['check'].split("read")[1].split()[0].replace(".plist","")
-                        check_length = len(rule_yaml['check'].split())
-                        key = rule_yaml['check'].split("\n")[0].replace(" 2>/dev/null","").split()[-1].replace('"','').replace(")",'')
-                            
-                        oval_object = oval_object + '''
-                            <accountinfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="home directory" id="oval:mscp:obj:{}" version="1">
-                <username operation="pattern match">.*</username>
-                <filter action="include" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5">oval:mscp:ste:{}</filter>
-            </accountinfo_object>
-            
-            <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_1_object" id="oval:mscp:obj:{}" version="1">
-                <filepath datatype="string" operation="equals" var_check="at least one" var_ref="oval:mscp:var:{}"/>    
-            '''.format(x+1999,x+1999,rule_yaml['id'] + "_" + odv_label,x,x)
-                        oval_object = oval_object + '''<xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-        </plist511_object>'''.format(key)    
-
-                        key = rule_yaml['check'].split("\n")[1].replace(" 2>/dev/null","").split()[-1].replace('"','').replace(")",'')
-                        
-                        oval_object = oval_object + '''
-                        <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_2_object" id="oval:mscp:obj:{}" version="1">
-                <filepath datatype="string" operation="equals" var_check="at least one" var_ref="oval:mscp:var:{}"/>    
-            '''.format(rule_yaml['id'] + "_" + odv_label,x+5000,x)
-
-                        oval_object = oval_object + '''<xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-        </plist511_object>'''.format(key)
-
-                        key = rule_yaml['check'].split("\n")[2].replace(" 2>/dev/null","").split()[-1].replace('"','').replace(")",'')
-                        
-                        oval_object = oval_object + '''
-                        <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_3_object" id="oval:mscp:obj:{}" version="1">
-                <filepath datatype="string" operation="equals" var_check="at least one" var_ref="oval:mscp:var:{}"/>    
-            '''.format(rule_yaml['id'] + "_" + odv_label,x+5001,x)
-
-                        oval_object = oval_object + '''<xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-        </plist511_object>'''.format(key)
-
-                        key = rule_yaml['check'].split("\n")[3].replace(" 2>/dev/null","").split()[-1].replace('"','').replace(")",'')
-                        
-                        oval_object = oval_object + '''
-                        <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_4_object" id="oval:mscp:obj:{}" version="1">
-                <filepath datatype="string" operation="equals" var_check="at least one" var_ref="oval:mscp:var:{}"/>    
-            '''.format(rule_yaml['id'] + "_" + odv_label,x+5002,x)
-                        oval_object = oval_object + '''<xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-        </plist511_object>'''.format(key)
-
-                        oval_state = oval_state + '''
-                        <accountinfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="home directory state" id="oval:mscp:ste:{}" version="1">
-                <username operation="pattern match">^[^_\s].*</username>
-                <uid datatype="int" operation="not equal">0</uid>
-                <gid datatype="int" operation="not equal">0</gid>
-                <login_shell operation="not equal">/usr/bin/false</login_shell>
-            </accountinfo_state>'''.format(x+1999)
-                        
-                        
-                        after_user = plist.split('"')[2]
-                        oval_variable = oval_variable + '''
-            <local_variable id="oval:mscp:var:{}" version="1" datatype="string" comment="uuid variable">
-                <concat>
-                    <object_component object_ref="oval:mscp:obj:{}" item_field="home_dir"/>
-                    <literal_component datatype="string">{}</literal_component>
-                    <literal_component datatype="string">.plist</literal_component>
-                </concat>
-            </local_variable>'''.format(x,x+1999,after_user,x+999)
-                        try:
-                            check_if = rule_yaml['check'].split("\n")[5]
-                        
-                            modifier = 0
-                            for n in check_if.split():
-                                
-                                if n.replace('"',"").isdigit():
-                                    if modifier >= 4999:
-                                        modifier = modifier + 1
-                                    oval_state = oval_state + '''<plist511_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_plist_state" id="oval:mscp:ste:{}" version="1">
-                        <value_of datatype="int" operation="not equal">{}</value_of>
-                    </plist511_state>'''.format(rule_yaml['id'] + "_" + odv_label,x+modifier,n.replace('"',""))
-                                    if modifier == 0:
-                                        modifier = 4999
-                            x = x + 1
-                            continue
-                        except:      
-                            x = x + 1  
-                            continue
-                    
-
-
-                    oval_definition = oval_definition + '''
-                        <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                        <title>{}</title> 
-                        <reference source="CCE" ref_id="{}"/>
-                        <reference source="macos_security" ref_id="{}"/>
-                        <description>{}</description> 
-                    </metadata> 
-                <criteria>
-                    <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                </criteria>
-            </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x)
-                    
-                    oval_test = oval_test + '''
-                        <plist511_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="all_exist" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                <object object_ref="oval:mscp:obj:{}" />
-                <state state_ref="oval:mscp:ste:{}" />
-            </plist511_test>'''.format(rule_yaml['id'] + "_" + odv_label,x,x,x)
-
-                    plist = rule_yaml['check'].split("read")[1].split()[0].replace(".plist","")
-                    
-                    if "ByHost" in rule_yaml['fix'] or "currentHost" in rule_yaml['fix']:
-                        
-                        oval_object = oval_object + '''
-                                    <systemprofiler_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}" id="oval:mscp:obj:{}" version="1">
-            <data_type>SPHardwareDataType</data_type>
-
-                <xpath>//*[contains(text(), "platform_UUID")]/following-sibling::string[position()=1]/text()</xpath>
-            </systemprofiler_object> '''.format("hardware UUID",x+999)
-
-                        if "$CURRENT_USER" in rule_yaml['check']:
-                            
-                            
-                            check_length = len(rule_yaml['check'].split())
-                            key = rule_yaml['check'].split()[check_length-1]
-                            
-                            oval_object = oval_object + '''
-                            <accountinfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="home directory" id="oval:mscp:obj:{}" version="1">
-                <username operation="pattern match">.*</username>
-                <filter action="include" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5">oval:mscp:ste:{}</filter>
-            </accountinfo_object>
-            
-            <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                <filepath datatype="string" operation="equals" var_check="at least one" var_ref="oval:mscp:var:{}"/>    
-            '''.format(x+1999,x+1999,rule_yaml['id'] + "_" + odv_label,x,x)
-                            
-                            try: 
-                                rule_yaml['result']['boolean']
-                                oval_object = oval_object + '''
-                        <xpath>name(//*[contains(text(), "{}")]/following-sibling::*[1])</xpath>
-    </plist511_object>'''.format(key)
-                            except:
-                                
-                                oval_object = oval_object + '''<xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-            </plist511_object>'''.format(key)
-                            oval_state = oval_state + '''
-                        <accountinfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="home directory state" id="oval:mscp:ste:{}" version="1">
-                <username operation="pattern match">^[^_\s].*</username>
-                <uid datatype="int" operation="not equal">0</uid>
-                <gid datatype="int" operation="not equal">0</gid>
-                <login_shell operation="not equal">/usr/bin/false</login_shell>
-            </accountinfo_state>'''.format(x+1999)
-                            
-                            oval_variable = oval_variable + '''
-        <local_variable id="oval:mscp:var:{}" version="1" datatype="string" comment="uuid variable">
-            <concat>
-                <object_component object_ref="oval:mscp:obj:{}" item_field="home_dir"/>
-                <literal_component datatype="string">/Library/Preferences/ByHost/{}.</literal_component>
-                <object_component object_ref="oval:mscp:obj:{}" item_field="value_of"/>
-                <literal_component datatype="string">.plist</literal_component>
-            </concat>
-        </local_variable>'''.format(x,x+1999,plist,x+999)
-
-                        
-
-                        else:
-                            
-                            check_length = len(rule_yaml['check'].split())
-                            key = rule_yaml['check'].replace(" 2>/dev/null","").split()[check_length-1]
-
-                            oval_object = oval_object + '''
-            <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                <filepath datatype="string" operation="equals" var_check="at least one" var_ref="oval:mscp:var:{}"/>
-                '''.format(rule_yaml['id'] + "_" + odv_label,x,x)
-
-                            try:
-                                rule_yaml['result']['boolean']
-                                oval_object = oval_object + '''
-                        <xpath>name(//*[contains(text(), "{}")]/following-sibling::*[1])</xpath>
-            </plist511_object>'''.format(key)
-                            except:
-                                oval_object = oval_object + '''
-                            <xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-            </plist511_object>'''.format(key)
-                            
-                            oval_variable = oval_variable + '''       
-        <local_variable id="oval:mscp:var:{}" version="1" datatype="string" comment="uuid variable">
-            <concat>
-                <literal_component datatype="string">{}.</literal_component>
-                <object_component object_ref="oval:mscp:obj:{}" item_field="value_of"/>
-                <literal_component datatype="string">.plist</literal_component>
-            </concat>
-        </local_variable>'''.format(x,plist,x+999)
-                    
-                    elif "$CURRENT_USER" in rule_yaml['check']:
-                        
-                            
-                        check_length = len(rule_yaml['check'].split())
-                        key = rule_yaml['check'].replace(" 2>/dev/null","").split()[-1]
-                        
-                        oval_object = oval_object + '''
-                        <accountinfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="home directory" id="oval:mscp:obj:{}" version="1">
-            <username operation="pattern match">.*</username>
-            <filter action="include" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5">oval:mscp:ste:{}</filter>
-        </accountinfo_object>
-        
-        <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-            <filepath datatype="string" operation="equals" var_check="at least one" var_ref="oval:mscp:var:{}"/>    
-        '''.format(x+1999,x+1999,rule_yaml['id'] + "_" + odv_label,x,x)
-                        
-                        try: 
-                            rule_yaml['result']['boolean']
-                            oval_object = oval_object + '''
-                    <xpath>name(//*[contains(text(), "{}")]/following-sibling::*[1])</xpath>
-    </plist511_object>'''.format(key)
-                        except:
-                            
-                            oval_object = oval_object + '''<xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-        </plist511_object>'''.format(key)
-                        oval_state = oval_state + '''
-                    <accountinfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="home directory state" id="oval:mscp:ste:{}" version="1">
-            <username operation="pattern match">^[^_\s].*</username>
-            <uid datatype="int" operation="not equal">0</uid>
-            <gid datatype="int" operation="not equal">0</gid>
-            <login_shell operation="not equal">/usr/bin/false</login_shell>
-        </accountinfo_state>'''.format(x+1999)
-                        
-                        oval_variable = oval_variable + '''
-    <local_variable id="oval:mscp:var:{}" version="1" datatype="string" comment="uuid variable">
-        <concat>
-            <object_component object_ref="oval:mscp:obj:{}" item_field="home_dir"/>
-            <literal_component datatype="string">/Library/Preferences/{}.</literal_component>
-            <literal_component datatype="string">plist</literal_component>
-        </concat>
-    </local_variable>'''.format(x,x+1999,plist,x+999)
-
-                    else:
-                        
-                        if plist[-6:] != ".plist":
-                            plist = plist + ".plist"
-                        
-                        plist_key = rule_yaml['check'].replace(" 2>/dev/null","").split(" ")[3].rstrip()
-                        oval_object = oval_object + '''
-                        <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                        <filepath>{}</filepath>'''.format(rule_yaml['id'] + "_" + odv_label,x,plist)
-                        
-                        try:
-                            rule_yaml['result']['boolean']
-                            oval_object = oval_object + '''
-                        <xpath>name(//*[contains(text(), "{}")]/following-sibling::*[1])</xpath>
-                        </plist511_object>'''.format(plist_key)
-                        except:
-                            oval_object = oval_object + '''
-                            <xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-                        </plist511_object>'''.format(plist_key)
-                        
-                        
-                    datatype = ""
-                    plist_key = rule_yaml['check'].split(" ")[3].rstrip()
-                    for key in rule_yaml['result']:
-                        datatype = key
-                    if datatype == "integer":
-                        oval_datatype = "int"
-
-                    else:
-                        oval_datatype = datatype
-
-                    if oval_datatype == "boolean" and rule_yaml['result'][datatype] == 0:
-                        value = "false"
-                    elif oval_datatype == "boolean" and rule_yaml['result'][datatype] == 1:
-                        value = "true"
-                    else:
-                        value = rule_yaml['result'][datatype]
-                        
-                    oval_state = oval_state + '''
-            <plist511_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-            <value_of datatype="{}" operation="equals">{}</value_of>
-            </plist511_state>'''.format(rule_yaml['id'] + "_" + odv_label,x,oval_datatype,value)
-                    oval_definition = re.sub('(?=\n\[NOTE\])(?s)(.*)\=\n<', '<', oval_definition)
-                    x = x+1
-                
-                    continue
-                try:
-                    if "security" in command[3]:
-                        if rule_yaml['check'].split()[1] == "authorizationdb":
-                            check = rule_yaml['check'].split("|")
-                            
-                            authdb = rule_yaml['check'].split()[3]
-                            if len(check) > 2:
-
-                                matches = re.findall(r'(?<=\>)(.*)(?=\<)',check[1])
-                                key = str(matches).replace("[","").replace("]","").replace("'","")
-
-                                length = len(check[2].split())
-                                
-                                last_string = check[2].split()[length-1].replace('"',"").replace("<","").replace(">","").replace("/","")
-                                
-
-                                oval_definition = oval_definition + '''
-                                    <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                        <metadata> 
-                            <title>{}</title> 
-                            <reference source="CCE" ref_id="{}"/>
-                            <reference source="macos_security" ref_id="{}"/>
-                            <description>{}</description> 
-                        </metadata> 
-                    <criteria>
-                        <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-
-                    </criteria>
-                </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x)
-
-                                oval_test = oval_test + '''
-                                    <authorizationdb_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="only_one_exists" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                    <object object_ref="oval:mscp:obj:{}" />
-                    <state state_ref="oval:mscp:ste:{}" />
-                </authorizationdb_test>'''.format(rule_yaml['id'] + "_" + odv_label,x,x,x)
-                                
-                                oval_object = oval_object + '''
-                                    <authorizationdb_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                    <right_name>{}</right_name>
-                    <xpath>boolean(//key[text()="{}"]/following-sibling::{})</xpath>
-                </authorizationdb_object>  '''.format(rule_yaml['id'] + "_" + odv_label,x,authdb,key,last_string)
-
-                                oval_state = oval_state  + '''
-                    <authorizationdb_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-                    
-                <value_of datatype="boolean" operation="equals">true</value_of>
-                </authorizationdb_state>'''.format(rule_yaml['id'] + "_" + odv_label,x)
-                            else:
-                                key = (check[1].split()[2].replace("'",""))
-                                key = key.split('>')[1].split('<')[0]
-                                oval_definition = oval_definition + '''
-                <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                        <metadata> 
-                            <title>{}</title> 
-                            <reference source="CCE" ref_id="{}"/>
-                            <reference source="macos_security" ref_id="{}"/>
-                            <description>{}</description> 
-                        </metadata> 
-                    <criteria>
-                        <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                    </criteria>
-                </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x)
-
-                                oval_test = oval_test + '''
-                <authorizationdb_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="only_one_exists" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                    <object object_ref="oval:mscp:obj:{}" />
-                    <state state_ref="oval:mscp:ste:{}" />
-                </authorizationdb_test>'''.format(rule_yaml['id'] + "_" + odv_label,x,x,x)
-
-                                oval_object = oval_object + '''
-                                <authorizationdb_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                    <right_name>{}</right_name>
-                    <xpath>//*[contains(text(), "{}")]/text()</xpath>
-                </authorizationdb_object>  '''.format(rule_yaml['id'] + "_" + odv_label,x,authdb,key)
-
-                                oval_state = oval_state + '''
-                                    <authorizationdb_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_test" id="oval:mscp:ste:{}" version="1">
-                    <value_of>{}</value_of>
-                </authorizationdb_state>'''.format(rule_yaml['id'] + "_" + odv_label,x,key)
-                        
-                        else:
-                            if "authorizationdb" in rule_yaml['check']:
-                                regex = r"=\(.*.\)"
-                                matchy_match = []
-                                matches = re.finditer(regex, rule_yaml['check'], re.MULTILINE)
-                                for matchNum, match in enumerate(matches, start=1):
-                                    matchy_match = match.group().replace('=(',"").replace(")","").replace('"','').split()
-                                
-                                oval_definition = oval_definition + '''
-                                    <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                        <metadata> 
-                            <title>{}</title> 
-                            <reference source="CCE" ref_id="{}"/>
-                            <reference source="macos_security" ref_id="{}"/>
-                            <description>{}</description> 
-                        </metadata> 
-                    <criteria operator="AND">'''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].replace("&","&amp;"))
-
-                                for match in matchy_match:
                                     
-                                    oval_definition = oval_definition + '''
-                                <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                                '''.format(rule_yaml['id'] + "+" + match, x)
-                                    oval_test = oval_test + '''
-                                    <authorizationdb_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="only_one_exists" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                    <object object_ref="oval:mscp:obj:{}" />
-                    <state state_ref="oval:mscp:ste:{}" />
-                </authorizationdb_test>'''.format(match,x,x,x)
-                                    key="shared"
-                                    value=""
-                                    if "false" in rule_yaml["check"]: 
-                                        value="false"
-                                    else:
-                                        value="true"
-
-                                    oval_object = oval_object + '''
-                                    <authorizationdb_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                    <right_name>{}</right_name>
-                    <xpath>boolean(//key[text()="{}"]/following-sibling::{})</xpath>
-                </authorizationdb_object>  '''.format(match,x,match,key,value)
-
-                                    oval_state = oval_state  + '''
-                    <authorizationdb_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-                    
-                <value_of datatype="boolean" operation="equals">true</value_of>
-                </authorizationdb_state>'''.format(match,x)
-                                    x += 1
-                                
-                                oval_definition = oval_definition + "</criteria></definition>"
-                        x += 1
-                        continue
-                except:
-                    pass
-                if "/bin/rm" in rule_yaml['fix'] and "/bin/ls" in rule_yaml['check']:
-                    oval_definition = oval_definition + '''
-                    <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                        <title>{}</title> 
-                        <reference source="CCE" ref_id="{}"/>
-                        <reference source="macos_security" ref_id="{}"/>
-                        <description>{}</description> 
-                    </metadata> 
-                <criteria> 
-                    <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                
-                </criteria> 
-            </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x)
-                    oval_test = oval_test + '''
-                            <file_test id="oval:mscp:tst:{}" version="1" comment="{}_test" check_existence="none_exist" check="none satisfy" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix">
-                <object object_ref="oval:mscp:obj:{}"/>
-            </file_test>'''.format(x,rule_yaml['id'] + "_" + odv_label,x)
-
-                    path = rule_yaml['fix'].split("----")[1].split(" ")[-1]
-                    
-                    oval_object = oval_object + '''
-            <file_object id="oval:mscp:obj:{}" version="1" comment="{}_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix">
-                <path>{}</path>
-                <filename xsi:nil="true" />            
-            </file_object>'''.format(x,rule_yaml['id'] + "_" + odv_label,path.rstrip())
-                    x += 1
-                    continue
-
-                try:
-                    if "ls" in command[2] or "stat" in command[3].split()[0]:
-                        if '/Library/Security/PolicyBanner.rtf' in rule_yaml['check']:
-                            
-                            
-                            oval_definition = oval_definition + '''
-                        <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                        <metadata> 
-                            <title>{}</title> 
-                            <reference source="CCE" ref_id="{}"/>
-                            <reference source="macos_security" ref_id="{}"/>
-                            <description>{}</description> 
-                        </metadata> 
-                    <criteria operator="OR"> 
-                        <criterion comment="{}_rtf_enforce" test_ref="oval:mscp:tst:{}" />
-                        <criterion comment="{}_rtfd_enforce" test_ref="oval:mscp:tst:{}" />
-                    </criteria> 
-                </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'],rule_yaml['id'] + "_" + odv_label,x,rule_yaml['id'] + "_" + odv_label,x+2999)
-
-                            oval_test = oval_test + '''
-                                <file_test id="oval:mscp:tst:{}" version="1" comment="{}_rtf_test" check_existence="all_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix">
-                    <object object_ref="oval:mscp:obj:{}"/>
-                </file_test>
-                <file_test id="oval:mscp:tst:{}" version="1" comment="{}_rtfd_test" check_existence="all_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix">
-                    <object object_ref="oval:mscp:obj:{}"/>
-                </file_test>'''.format(x,rule_yaml['id'] + "_" + odv_label,x,x+2999,rule_yaml['id'] + "_" + odv_label,x+2999)
-
-                            oval_object = oval_object + '''
-                <file_object id="oval:mscp:obj:{}" version="1" comment="{}_rtf_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix">
-                    <path>/Library/Security/PolicyBanner.rtf</path>
-                    <filename xsi:nil="true" />            
-                </file_object>
-                <file_object id="oval:mscp:obj:{}" version="1" comment="{}_rtfd_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix">
-                    <path>/Library/Security/PolicyBanner.rtfd</path>
-                    <filename xsi:nil="true" />            
-                </file_object>'''.format(x,rule_yaml['id'] + "_" + odv_label,x+2999,rule_yaml['id'])
-                            x = x + 1
-                            continue
-                    
-                        s = rule_yaml['check']
-                        config_file = str()
-                        oval_variable_need = bool()
-                        if "grep" in s.split()[2]:
-                            
-                            
-                            oval_variable_need = True
-                            grep_search = re.search('\((.*?)\)', s).group(1)
-                        
-                            substring = grep_search.split("|")[0]
-                            regex = re.search('\'(.*?)\'', substring).group(1)
-                            
-                            try:
-                                regex = re.search('/(.*?)/', regex).group(1)
-                            except:
-                                regex = regex
-
-                            config_file = substring = grep_search.split("|")[0].split()[-1]                    
-
-                            oval_object = oval_object + '''
-                <textfilecontent54_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" version="1" comment="{}_var_object" id="oval:mscp:obj:{}">
-                    <filepath datatype="string" operation="equals">{}</filepath>
-                    <pattern datatype="string" operation="pattern match">{}:\s*(.*)$</pattern>
-                    <instance datatype="int" operation="greater than or equal">1</instance>
-                </textfilecontent54_object>
-                '''.format(rule_yaml['id'] + "_" + odv_label, x+999, config_file, regex)
-
-                            oval_variable = oval_variable + '''
-                    <local_variable id="oval:mscp:var:{}" version="1" datatype="string" comment="{}_var">
-                    <object_component object_ref="oval:mscp:obj:{}" item_field="subexpression"/>
-                    </local_variable>'''.format(x,rule_yaml['id'] + "_" + odv_label,x+999)
-                        
-                        else:
-                            oval_variable_need = False
-                            config_file = s.split()[2]
-
-                        s = rule_yaml['fix']
-
-                        fix_command = re.search('-\n(.*?)\n-', s).group(1).split('$')[0]
-                    
-                        oval_definition = oval_definition + '''
-                        
-                    <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                        <metadata> 
-                            <title>{}</title> 
-                            <reference source="CCE" ref_id="{}"/>
-                            <reference source="macos_security" ref_id="{}"/>
-                            <description>{}</description> 
-                        </metadata> 
-                    <criteria> 
-                        <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                    </criteria> 
-                </definition> 
-            '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].replace("&","&amp;").rstrip(),rule_yaml['id'] + "_" + odv_label,x)
-
-                        oval_test = oval_test + '''
-                <file_test id="oval:mscp:tst:{}" version="1" comment="{}_test" check_existence="all_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix">
-                    <object object_ref="oval:mscp:obj:{}"/>
-                    <state state_ref="oval:mscp:ste:{}"/>
-                </file_test>'''.format(x,rule_yaml['id'] + "_" + odv_label,x,x)
-                        
-                        if "-" in fix_command and "R" in fix_command or rule_yaml['fix'].split("\n")[2][-1] == "*":
-                            behavior = '<behaviors recurse="symlinks and directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"></behaviors>'
-                            if "audit" in rule_yaml['id']:
-                                filename = '<filename datatype="string" operation="not equal">current</filename>'
-                        else:
-                            behavior = ""
-                            filename = '<filename xsi:nil="true"/>'
-
-                        if oval_variable_need == True:
-                            oval_object = oval_object + '''
-                    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" version="1" comment="{}_object" id="oval:mscp:obj:{}">
-                    {}
-                    <path datatype="string" operation="equals" var_ref="oval:mscp:var:{}"></path>
-                    {}
-                    </file_object>'''.format(rule_yaml['id'] + "_" + odv_label,x,behavior,x,filename)
-                        else:
-                            oval_object = oval_object + '''
-                    <file_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" version="1" comment="{}_object" id="oval:mscp:obj:{}">
-                    {}
-                    <filepath datatype="string" operation="equals">{}</filepath>
-                    
-                    </file_object>'''.format(rule_yaml['id'] + "_" + odv_label,x,behavior,config_file)
-                        state_test = ""
-                        if "-" in fix_command and "N" in fix_command and "chmod" in fix_command:
-                            state_test = '''
-                            <has_extended_acl datatype="boolean">false</has_extended_acl>
-                            '''
-                        
-                        elif "chgrp" in fix_command:
-                            state_test = '''
-                            <group_id>{}</group_id>
-                            '''.format(rule_yaml['result']['integer'])
-
-                        elif "chown" in fix_command:
-                    
-                            state_test = '''
-                            <user_id>{}</user_id>
-                            '''.format(rule_yaml['result']['integer'])
-                
-
-                        elif "chmod" in fix_command:
-                            
-                            perms = fix_command.split()[1]
-                            
-                            if perms[0] == "0":
-                                state_test = '''
-                <uread datatype="boolean">false</uread>
-                <uwrite datatype="boolean">false</uwrite>
-                <uexec datatype="boolean">false</uexec>'''
-                            if perms[0] == "1":
-                                state_test = '''
-                <uread datatype="boolean">false</uread>
-                <uwrite datatype="boolean">false</uwrite>
-                <uexec datatype="boolean">true</uexec>'''
-                            elif perms[0] == "2":
-                                state_test = '''
-                <uread datatype="boolean">false</uread>
-                <uwrite datatype="boolean">true</uwrite>
-                <uexec datatype="boolean">false</uexec>'''
-                            elif perms[0] == "3":
-                                state_test = '''
-                <uread datatype="boolean">false</uread>
-                <uwrite datatype="boolean">true</uwrite>
-                <uexec datatype="boolean">true</uexec>'''
-                            elif perms[0] == "4":
-                                
-                                state_test = '''
-                <uread datatype="boolean">true</uread>
-                <uwrite datatype="boolean">false</uwrite>
-                <uexec datatype="boolean">false</uexec>'''
-                            elif perms[0] == "5":
-                                state_test = '''
-                <uread datatype="boolean">true</uread>
-                <uwrite datatype="boolean">false</uwrite>
-                <uexec datatype="boolean">true</uexec>'''
-                            elif perms[0] == "6":
-                                state_test = '''
-                <uread datatype="boolean">true</uread>
-                <uwrite datatype="boolean">true</uwrite>
-                <uexec datatype="boolean">false</uexec>'''
-                            elif perms[0] == "7":
-                                state_test = '''
-                <uread datatype="boolean">true</uread>
-                <uwrite datatype="boolean">true</uwrite>
-                <uexec datatype="boolean">true</uexec>'''
-                            
-                            if perms[1] == "0":
-                                state_test = state_test + '''
-                <gread datatype="boolean">false</gread>
-                <gwrite datatype="boolean">false</gwrite>
-                <gexec datatype="boolean">false</gexec>'''
-                            elif perms[1] == "1":
-                                state_test = state_test + '''
-                <gread datatype="boolean">false</gread>
-                <gwrite datatype="boolean">false</gwrite>
-                <gexec datatype="boolean">true</gexec>'''
-                            elif perms[1] == "2":
-                                state_test = state_test + '''
-                <gread datatype="boolean">false</gread>
-                <gwrite datatype="boolean">true</gwrite>
-                <gexec datatype="boolean">false</gexec>'''
-                            elif perms[1] == "3":
-                                state_test = state_test + '''
-                <gread datatype="boolean">false</gread>
-                <gwrite datatype="boolean">true</gwrite>
-                <gexec datatype="boolean">true</gexec>'''
-                            elif perms[1] == "4":
-                                
-                                state_test = state_test + '''
-                <gread datatype="boolean">true</gread>
-                <gwrite datatype="boolean">false</gwrite>
-                <gexec datatype="boolean">false</gexec>'''
-                            elif perms[1] == "5":
-                                state_test = state_test + '''
-                <gread datatype="boolean">true</gread>
-                <gwrite datatype="boolean">false</gwrite>
-                <gexec datatype="boolean">true</gexec>'''
-                            elif perms[1] == "6":
-                                state_test = state_test + '''
-                <gread datatype="boolean">true</gread>
-                <gwrite datatype="boolean">true</gwrite>
-                <gexec datatype="boolean">false</gexec>'''
-                            elif perms[1] == "7":
-                                state_test = state_test + '''
-                <gread datatype="boolean">true</gread>
-                <gwrite datatype="boolean">true</gwrite>
-                <gexec datatype="boolean">true</gexec>'''
-
-                            if perms[2] == "0":
-                                
-                                state_test = state_test + '''
-                <oread datatype="boolean">false</oread>
-                <owrite datatype="boolean">false</owrite>
-                <oexec datatype="boolean">false</oexec>'''        
-                            if perms[2] == "1":
-                                state_test = state_test + '''
-                <oread datatype="boolean">false</oread>
-                <owrite datatype="boolean">false</owrite>
-                <oexec datatype="boolean">true</oexec>'''
-                            elif perms[2] == "1":
-                                state_test = state_test + '''
-                <oread datatype="boolean">false</oread>
-                <owrite datatype="boolean">false</owrite>
-                <oexec datatype="boolean">true</oexec>'''
-                            elif perms[2] == "2":
-                                state_test = state_test + '''
-                <oread datatype="boolean">false</oread>
-                <owrite datatype="boolean">true</owrite>
-                <oexec datatype="boolean">false</oexec>'''
-                            elif perms[2] == "3":
-                                state_test = state_test + '''
-                <oread datatype="boolean">false</oread>
-                <owrite datatype="boolean">true</owrite>
-                <oexec datatype="boolean">true</oexec>'''
-                            elif perms[2] == "4":
-                                state_test = state_test + '''
-                <oread datatype="boolean">true</oread>
-                <owrite datatype="boolean">false</owrite>
-                <oexec datatype="boolean">false</oexec>'''
-                            elif perms[2] == "5":
-                                state_test = state_test + '''
-                <oread datatype="boolean">true</oread>
-                <owrite datatype="boolean">false</owrite>
-                <oexec datatype="boolean">true</oexec>'''
-                            elif perms[2] == "6":
-                                state_test = state_test + '''
-                <oread datatype="boolean">true</oread>
-                <owrite datatype="boolean">true</owrite>
-                <oexec datatype="boolean">false</oexec>'''
-                            elif perms[2] == "7":
-                                state_test = state_test + '''
-                <oread datatype="boolean">true</oread>
-                <owrite datatype="boolean">true</owrite>
-                <oexec datatype="boolean">true</oexec>'''
-
-                        oval_state = oval_state + '''
-                <file_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" version="1" comment="{}_state" id="oval:mscp:ste:{}">'''.format(rule_yaml['id'] + "_" + odv_label,x) + state_test + '''
-                </file_state>
-                        '''
-                    
-                        x += 1
-                        continue
-                except:
-                    pass
-                try:
-                    if "dscl" in command[3]:
-                            if "UserShell" in rule_yaml['check']:
-                                shell = rule_yaml['check'].split()[9].replace('"','')
-                                oval_definition = oval_definition + '''
-                <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                        <metadata> 
-                            <title>{}</title> 
-                            <reference source="CCE" ref_id="{}"/>
-                            <reference source="macos_security" ref_id="{}"/>
-                            <description>{}</description> 
-                        </metadata> 
-                    <criteria>
-                        <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                    </criteria>
-                </definition> 
-                '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].replace("&","&amp;"),rule_yaml['id'] + "_" + odv_label,x)
-                                
-                                oval_test = oval_test + '''
-                <accountinfo_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="only_one_exists" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                    <object object_ref="oval:mscp:obj:{}" />
-                    <state state_ref="oval:mscp:ste:{}" />
-                </accountinfo_test>
-                '''.format(rule_yaml['id'] + "_" + odv_label,x,x,x)
-
-                                oval_object = oval_object + '''
-                    <accountinfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                <username>{}</username>
-                </accountinfo_object>
-                '''.format(rule_yaml['id'] + "_" + odv_label,x,command[5].split()[0])
-                                
-                                oval_state = oval_state + '''
-                                <accountinfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-                <login_shell>{}</login_shell>
-                </accountinfo_state>
-                '''.format(rule_yaml['id'] + "_" + odv_label,x,shell)
-                                x += 1
-                                continue
-                except:
-                    pass
-                try:
-                    if "awk" in command[3]:
-                        awk_file = ""
-                        awk_search = ""
-                        field_sep = ""
-                        
-                        if "grep -qE" in rule_yaml['fix']:
-                            awk_file = rule_yaml['fix'].split(" ")[3].strip(" ")
-                            awk_search = rule_yaml['fix'].split(" ")[2].strip("\"")
-                            
-                        elif "grep" in rule_yaml['check']:
-
-                            awk_file = rule_yaml['check'].split("|")[0].split(" ")[-2]
-                            awk_search = rule_yaml['check'].split("|")[-1].split(" ")[-2].strip("\'")
-                            
-                        else:
-                            awk_file = rule_yaml['check'].split("'")[2].strip(" ")
-                            awk_search = rule_yaml['check'].split("'")[1].split("/")[1]
-                            
-                            try: 
-                                field_sep = rule_yaml['check'].split("-F")[1].split(" ")[0].replace('\"',"")
-
-                            except:
-                                field_sep = " "
-
-                            try: 
-                        
-                                awk_result = rule_yaml['result']['string']
-
-                            except: 
-                                
-                                awk_result = str(rule_yaml['result']['integer'])
-                            
-                            if awk_search[0] != "^":
-                                awk_search = "^" + awk_search + field_sep + awk_result
-                            else:
-                                awk_search = awk_search + field_sep + awk_result
-
-                        
-                        oval_definition = oval_definition + '''
-                <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                        <metadata> 
-                            <title>{}</title> 
-                            <reference source="CCE" ref_id="{}"/>
-                            <reference source="macos_security" ref_id="{}"/>
-                            <description>{}</description> 
-                        </metadata> 
-                    <criteria> 
-                        <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                    </criteria> 
-                </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].rstrip(),rule_yaml['id'] + "_" + odv_label,x)
-                        oval_test = oval_test + '''
-                        <textfilecontent54_test id="oval:mscp:tst:{}" version="1" comment="{}_test" check_existence="all_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                    <object object_ref="oval:mscp:obj:{}"/>
-                </textfilecontent54_test>
-                '''.format(x, rule_yaml['id'] + "_" + odv_label, x)
-                        oval_object = oval_object + '''
-                        <textfilecontent54_object id="oval:mscp:obj:{}" version="1" comment="{}_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                    <filepath>{}</filepath>
-                    <pattern operation="pattern match">{}</pattern>
-                    <instance datatype="int">1</instance>
-                </textfilecontent54_object>
-                '''.format(x,rule_yaml['id'] + "_" + odv_label,awk_file.rstrip(), awk_search)
-                        x += 1
-                        continue
-                except:
-                    pass
-                try:
-                    if "grep" in command[3] and not "pgrep" in command[3]:
-                        
-                        if "bannerText" in rule_yaml['check'] or "fips_" in rule_yaml['check']:
-                            
-                            text_to_find = rule_yaml['check'].split("=")[1].split('"')[1]
-
-                            matches = text_to_find.replace(".","\.").replace(")","\)").replace("(","\(").replace("*","\*")
-                            
-                            oval_definition = oval_definition + '''
-            <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                        <title>{}</title> 
-                        <reference source="CCE" ref_id="{}"/>
-                        <reference source="macos_security" ref_id="{}"/>
-                        <description>{}</description> 
-                    </metadata>
-                <criteria> 
-                    <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                </criteria> 
-            </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].rstrip(),rule_yaml['id'] + "_" + odv_label,x)
-                            oval_test = oval_test + '''
-                    <textfilecontent54_test id="oval:mscp:tst:{}" version="1" comment="{}_test" check_existence="all_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                <object object_ref="oval:mscp:obj:{}"/>
-            </textfilecontent54_test>
-            '''.format(x, rule_yaml['id'] + "_" + odv_label, x)
-                            
-                            file_path = rule_yaml["check"].split(" ")[-1].rstrip()
-                            
-                            oval_object = oval_object + '''
-                    <textfilecontent54_object id="oval:mscp:obj:{}" version="1" comment="{}_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                <filepath>{}</filepath>
-                <pattern operation="pattern match">{}</pattern>
-                <instance datatype="int">1</instance>
-            </textfilecontent54_object>'''.format(x,rule_yaml['id'] + "_" + odv_label,file_path,matches)
-
-                            x += 1
-                            continue
-                        else:
-                            
-                            s = rule_yaml['check']
-                            
-                            try: 
-                                
-                                grep_search = re.search('"(.*?)"', s).group(1)
-                                
-                            except: 
-                                
-                                grep_search = re.search('\'(.*?)\'', s).group(1)
-                                
-                            
-                            grep_file = rule_yaml['check'].split(grep_search,1)[1].split(" ")[1]
-                            
-                            
-                            oval_definition = oval_definition + '''
-                <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                        <metadata> 
-                            <title>{}</title> 
-                            <reference source="CCE" ref_id="{}"/>
-                            <reference source="macos_security" ref_id="{}"/>
-                            <description>{}</description> 
-                        </metadata> 
-                    <criteria> 
-                        <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                    </criteria> 
-                </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].rstrip(),rule_yaml['id'] + "_" + odv_label,x)
-                            oval_test = oval_test + '''
-                        <textfilecontent54_test id="oval:mscp:tst:{}" version="1" comment="{}_test" check_existence="all_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                    <object object_ref="oval:mscp:obj:{}"/>
-                </textfilecontent54_test>
-                '''.format(x, rule_yaml['id'] + "_" + odv_label, x)
-                            oval_object = oval_object + '''
-                        <textfilecontent54_object id="oval:mscp:obj:{}" version="1" comment="{}_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
-                    <filepath>{}</filepath>
-                    <pattern operation="pattern match">{}</pattern>
-                    <instance datatype="int">1</instance>
-                </textfilecontent54_object>
-                '''.format(x,rule_yaml['id'] + "_" + odv_label,grep_file.rstrip(),grep_search)
-                            x += 1
-                            continue
-                except:
-                    pass
-                try:
-                    if "launchctl" in command[2] or "launchctl" in rule_yaml['fix']:
-                        if ("disable" in command[2] and "=> true" in rule_yaml['check'] or "unload -w" in rule_yaml['fix'] or "disable" in command[2] and "=> disabled" in rule_yaml['check']) or ("disable" in rule_yaml['fix']):
-                            oval_definition = oval_definition + '''
-                <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                            <title>{}</title> 
-                            <reference source="CCE" ref_id="{}"/>
-                            <reference source="macos_security" ref_id="{}"/>
-                            <description>{}</description> 
-                    </metadata> 
-                    <criteria operator="AND">
-                        <criterion comment="{}_plist" test_ref="oval:mscp:tst:{}" />
-                        <criterion comment="{}_launchctl" test_ref="oval:mscp:tst:{}" />
-                    </criteria>
-                </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].rstrip(),rule_yaml['id'] + "_" + odv_label,x,rule_yaml['id'] + "_" + odv_label,x+999)                            
-                            oval_test = oval_test + '''
-                <plist511_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="only_one_exists" comment="{}_plist_test" id="oval:mscp:tst:{}" version="2">
-                    <object object_ref="oval:mscp:obj:{}" />
-                    <state state_ref="oval:mscp:ste:{}" />
-                </plist511_test>
-                <launchd_test id="oval:mscp:tst:{}" version="1" comment="{}_launchctl_test" check_existence="none_exist" check="none satisfy" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos">
-                    <object object_ref="oval:mscp:obj:{}"/>
-                
-                </launchd_test>'''.format(rule_yaml['id'] + "_" + odv_label,x,x,x,x+999,rule_yaml['id'] + "_" + odv_label,x+999)
-                            
-                            domain = str()
-                            if "launchctl" not in rule_yaml['check']:
-                                if "launchctl disable system/" in rule_yaml["fix"]:
-                                    domain = rule_yaml['fix'].split()[4].split('/')[1]
-                                else:
-                                    domain = rule_yaml['fix'].split()[4].split('/')[4].replace(".plist","")
-                            else:                                
-                                s = command[5].split()[2]
-                                domain = re.search('"(.*?)"', s).group(1)
-                            
-                            oval_object = oval_object + '''
-                <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_plist_object" id="oval:mscp:obj:{}" version="1">
-                    <filepath>/var/db/com.apple.xpc.launchd/disabled.plist</filepath>
-                    <xpath>name(//*[contains(text(), "{}")]/following-sibling::*[1])</xpath>
-                </plist511_object>
-                <launchd_object id="oval:mscp:obj:{}" version="1" comment="{}_launchctl_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos">
-                    <label>{}</label>
-                </launchd_object>'''.format(rule_yaml['id'] + "_" + odv_label,x,domain,x+999,rule_yaml['id'] + "_" + odv_label,domain.replace('(','').replace(')',''))
-                            
-                            status = ""
-                            if "enable" in rule_yaml["fix"]:
-                                status = "false"
-                            else:
-                                status = "true"
-                            oval_state = oval_state + '''
-                <plist511_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_plist_state" id="oval:mscp:ste:{}" version="1">
-                    <value_of datatype="boolean" operation="equals">{}</value_of>
-                </plist511_state>'''.format(rule_yaml['id'] + "_" + odv_label,x,status)
-                        
-                        elif "launchctl unload" in rule_yaml['fix'] or "launchctl disable" in rule_yaml['fix']:
-                            oval_definition = oval_definition + '''
-                <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                    <metadata> 
-                            <title>{}</title> 
-                            <reference source="CCE" ref_id="{}"/>
-                            <reference source="macos_security" ref_id="{}"/>
-                            <description>{}</description> 
-                    </metadata> 
-                    <criteria>
-                        <criterion comment="{}_launchctl" test_ref="oval:mscp:tst:{}" />
-                    </criteria>
-                </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].rstrip(),rule_yaml['id'] + "_" + odv_label,x,rule_yaml['id'] + "_" + odv_label,x+999)
-
-                            oval_test = oval_test + '''
-                <launchd_test id="oval:mscp:tst:{}" version="1" comment="{}_launchctl_test" check_existence="none_exist" check="none satisfy" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos">
-                    <object object_ref="oval:mscp:obj:{}"/>
-                </launchd_test>'''.format(x,rule_yaml['id'] + "_" + odv_label,x)
-                            
-                            domain = str()
-                            
-                            if "launchctl" not in rule_yaml['check']:
-                                domain = rule_yaml['fix'].split()[4].split('/')[4].replace(".plist","")
-                                
-                            else:
-                                s = command[5].split()[2]
-                                domain = re.search('"(.*?)"', s).group(1)
-                            
-                            oval_object = oval_object + '''
-                <launchd_object id="oval:mscp:obj:{}" version="1" comment="{}_launchctl_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos">
-                    <label>{}</label>
-                </launchd_object>'''.format(x, rule_yaml['id'] + "_" + odv_label,domain.replace('(','').replace(')',''))
-                        
-
-
-
-                        elif "defaults write" in rule_yaml['fix']:
-                            oval_definition = oval_definition + '''
-                                <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                            <metadata> 
-                                <title>{}</title> 
-                                <reference source="CCE" ref_id="{}"/>
-                                <reference source="macos_security" ref_id="{}"/>
-                                <description>{}</description> 
-                            </metadata> 
-                        <criteria>
-                            <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                        </criteria>
-                    </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'],rule_yaml['id'] + "_" + odv_label,x)
-                            
-                            oval_test = oval_test + '''
-                                <plist511_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" check="all" check_existence="all_exist" comment="{}_test" id="oval:mscp:tst:{}" version="2">
-                        <object object_ref="oval:mscp:obj:{}" />
-                        <state state_ref="oval:mscp:ste:{}" />
-                    </plist511_test>'''.format(rule_yaml['id'] + "_" + odv_label,x,x,x)
-                            plist = rule_yaml['fix'].split(" ")[2].replace(".plist","")
-                            
-                            if "ByHost" in rule_yaml['fix'] or "currentHost" in rule_yaml['fix']:
-                                
-                                oval_object = oval_object + '''
-                                            <systemprofiler_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}" id="oval:mscp:obj:{}" version="1">
-                    <data_type>SPHardwareDataType</data_type>
-
-                        <xpath>//*[contains(text(), "platform_UUID")]/following-sibling::string[position()=1]/text()</xpath>
-                    </systemprofiler_object> '''.format("hardware UUID",x+999)
-
-                                if "$CURRENT_USER" in rule_yaml['check']:
-                                    
-                                    
-                                    
-                                    key = rule_yaml['fix'].split("defaults")[1].split(" ")[3]
-                                    
-                                    oval_object = oval_object + '''
-                                    <accountinfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="home directory" id="oval:mscp:obj:{}" version="1">
-                        <username operation="pattern match">.*</username>
-                        <filter action="include" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5">oval:mscp:ste:{}</filter>
-                    </accountinfo_object>
-                    
-                    <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                        <filepath datatype="string" operation="equals" var_check="at least one" var_ref="oval:mscp:var:{}"/>    
-                    '''.format(x+1999,x+1999,rule_yaml['id'] + "_" + odv_label,x,x)
-                                    
-                                    if rule_yaml['fix'].split("defaults")[1].split(" ")[4] == "-bool":
-                                        rule_yaml['result']['boolean']
-                                        oval_object = oval_object + '''
-                                <xpath>name(//*[contains(text(), "{}")]/following-sibling::*[1])</xpath>
-            </plist511_object>'''.format(key)
-                                    else:
                                         
-                                        oval_object = oval_object + '''<xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-                    </plist511_object>'''.format(key)
-                                    oval_state = oval_state + '''
-                                <accountinfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="home directory state" id="oval:mscp:ste:{}" version="1">
-                        <username operation="pattern match">^[^_\s].*</username>
-                        <uid datatype="int" operation="not equal">0</uid>
-                        <gid datatype="int" operation="not equal">0</gid>
-                        <login_shell operation="not equal">/usr/bin/false</login_shell>
-                    </accountinfo_state>'''.format(x+1999)
-                                    
-                                    oval_variable = oval_variable + '''
-                <local_variable id="oval:mscp:var:{}" version="1" datatype="string" comment="uuid variable">
-                    <concat>
-                        <object_component object_ref="oval:mscp:obj:{}" item_field="home_dir"/>
-                        <literal_component datatype="string">/Library/Preferences/ByHost/{}.</literal_component>
-                        <object_component object_ref="oval:mscp:obj:{}" item_field="value_of"/>
-                        <literal_component datatype="string">.plist</literal_component>
-                    </concat>
-                </local_variable>'''.format(x,x+1999,plist,x+999)
-
-                                
-
-                                else:
-                                    
-                                    
-                                    key = rule_yaml['fix'].split("defaults")[1].split(" ")[3]
-
-                                    oval_object = oval_object + '''
-                    <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                        <filepath datatype="string" operation="equals" var_check="at least one" var_ref="oval:mscp:var:{}"/>
-                        '''.format(rule_yaml['id'] + "_" + odv_label,x,x)
-
-                                    
-                                    if rule_yaml['fix'].split("defaults")[1].split(" ")[4] == "-bool":
-                                        
-                                        oval_object = oval_object + '''
-                                <xpath>name(//*[contains(text(), "{}")]/following-sibling::*[1])</xpath>
-                    </plist511_object>'''.format(key)
-                                    else:
-                                        oval_object = oval_object + '''
-                                    <xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-                    </plist511_object>'''.format(key)
-                                    
-                                    oval_variable = oval_variable + '''       
-                <local_variable id="oval:mscp:var:{}" version="1" datatype="string" comment="uuid variable">
-                    <concat>
-                        <literal_component datatype="string">{}.</literal_component>
-                        <object_component object_ref="oval:mscp:obj:{}" item_field="value_of"/>
-                        <literal_component datatype="string">.plist</literal_component>
-                    </concat>
-                </local_variable>'''.format(x,plist,x+999)
+                if "launchctl list" in rule_yaml['check']:
+                    rule_yaml['check'] = rule_yaml['check'].replace("launchctl list", "launchctl print system")
+                    if "auditd_enabled" in rule_yaml['id']:
+                        rule_yaml['check'] = rule_yaml['check'].replace("/usr/bin/grep -c com.apple.auditd", "/usr/bin/grep -c '\"com.apple.auditd\" => enabled'")
+                        
                             
-                            elif "$CURRENT_USER" in rule_yaml['check']:
-                                
-                                    
-                                check_length = len(rule_yaml['check'].split())
-                                key = rule_yaml['fix'].split("defaults")[1].split(" ")[3]
-                                
-                                oval_object = oval_object + '''
-                                <accountinfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="home directory" id="oval:mscp:obj:{}" version="1">
-                    <username operation="pattern match">.*</username>
-                    <filter action="include" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5">oval:mscp:ste:{}</filter>
-                </accountinfo_object>
-                
-                <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                    <filepath datatype="string" operation="equals" var_check="at least one" var_ref="oval:mscp:var:{}"/>    
-                '''.format(x+1999,x+1999,rule_yaml['id'] + "_" + odv_label,x,x)
-                                
-                                if rule_yaml['fix'].split("defaults")[1].split(" ")[4] == "-bool":
-                                    
-                                    oval_object = oval_object + '''
-                            <xpath>name(//*[contains(text(), "{}")]/following-sibling::*[1])</xpath>
-            </plist511_object>'''.format(key)
-                                else:
-                                    
-                                    oval_object = oval_object + '''<xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-                </plist511_object>'''.format(key)
-                                oval_state = oval_state + '''
-                            <accountinfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="home directory state" id="oval:mscp:ste:{}" version="1">
-                    <username operation="pattern match">^[^_\s].*</username>
-                    <uid datatype="int" operation="not equal">0</uid>
-                    <gid datatype="int" operation="not equal">0</gid>
-                    <login_shell operation="not equal">/usr/bin/false</login_shell>
-                </accountinfo_state>'''.format(x+1999)
-                                
-                                oval_variable = oval_variable + '''
-            <local_variable id="oval:mscp:var:{}" version="1" datatype="string" comment="uuid variable">
-                <concat>
-                    <object_component object_ref="oval:mscp:obj:{}" item_field="home_dir"/>
-                    <literal_component datatype="string">/Library/Preferences/{}.</literal_component>
-                    <literal_component datatype="string">plist</literal_component>
-                </concat>
-            </local_variable>'''.format(x,x+1999,plist,x+999)
-
-                            else:
-                                
-                                if plist[-6:] != ".plist":
-                                    plist = plist + ".plist"
-                                plist_key = rule_yaml['fix'].split("defaults")[1].split(" ")[3]
-                                
-                                oval_object = oval_object + '''
-                                <plist511_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_object" id="oval:mscp:obj:{}" version="1">
-                                <filepath>{}</filepath>'''.format(rule_yaml['id'] + "_" + odv_label,x,plist)
-                                
-                                try:
-                                    rule_yaml['result']['boolean']
-                                    oval_object = oval_object + '''
-                                <xpath>name(//*[contains(text(), "{}")]/following-sibling::*[1])</xpath>
-                                </plist511_object>'''.format(plist_key)
-                                except:
-                                    oval_object = oval_object + '''
-                                    <xpath>//*[contains(text(), "{}")]/following-sibling::*[1]/text()</xpath>
-                                </plist511_object>'''.format(plist_key)
-                                
-                                
-                            datatype = ""
-                            plist_key = rule_yaml['fix'].split("defaults")[1].split(" ")[3]
-                            
-                            oval_datatype = rule_yaml['fix'].split("defaults")[1].split(" ")[4].replace("-","")
-
-                            if oval_datatype == "integer":
-                                oval_datatype = "int"
-                            
-                            if oval_datatype == "bool":
-                                oval_datatype = "boolean"
-
-                            value = rule_yaml['fix'].split("defaults")[1].split(" ")[5].replace(";","")
-                                
-                            oval_state = oval_state + '''
-                    <plist511_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" comment="{}_state" id="oval:mscp:ste:{}" version="1">
-                    <value_of datatype="{}" operation="equals">{}</value_of>
-                    </plist511_state>'''.format(rule_yaml['id'] + "_" + odv_label,x,oval_datatype,value)
-                            oval_definition = re.sub('(?=\n\[NOTE\])(?s)(.*)\=\n<', '<', oval_definition)
-
-
-                            x = x+1
+                if "/usr/bin/wc -l" in rule_yaml['check']:
+                    new_test = []
+                    for command in rule_yaml['check'].split("|"):
+                        if "/usr/bin/wc -l" in command:
+                            break
+                        new_test.append(command.strip())
+                    count_found = True
                     
-                            continue                        
-                        else:
-                            oval_definition = oval_definition + '''
-                <definition id="oval:mscp:def:{}" version="1" class="compliance"> 
-                        <metadata> 
-                            <title>{}</title> 
-                            <reference source="CCE" ref_id="{}"/>
-                            <reference source="macos_security" ref_id="{}"/>
-                            <description>{}</description> 
-                        </metadata> 
-                    <criteria> 
-                        <criterion comment="{}" test_ref="oval:mscp:tst:{}" />
-                    </criteria> 
-                </definition> '''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,rule_yaml['discussion'].rstrip(),rule_yaml['id'] + "_" + odv_label,x)
+                    rule_yaml['check'] = "|".join(new_test)
+                    if check_result == 0:
+                        check_existance = "none_exist"
+                
 
-                            oval_test = oval_test + '''
-                <launchd_test id="oval:mscp:tst:{}" version="1" comment="{}_test" check_existence="all_exist" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos">
-                    <object object_ref="oval:mscp:obj:{}"/>
-                </launchd_test>'''.format(x,rule_yaml['id'] + "_" + odv_label,x)
-                            
-                            domain = command[5].split()[2]
-                            domain = domain.replace('"','').replace("'",'')
-                            ###########
-                            label_obj = '<label>'
-                            if 'E' in command[5].split()[1]:
-                                label_obj = '<label operation="pattern match">'
-                            else:
-                                domain = domain.replace('(','').replace(')','')
-                            oval_object = oval_object + '''
-                <launchd_object id="oval:mscp:obj:{}" version="1" comment="{}_object" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos">
-                    {}{}</label>
-                </launchd_object>'''.format(x,rule_yaml['id'] + "_" + odv_label,label_obj,domain)
-                        x += 1
-                        continue    
-                except:
-                    pass
-        
+                oval_definition = oval_definition + '''
+    <definition id="oval:mscp:def:{0}" version="1" class="compliance">
+      <metadata>
+        <title>{1}</title>        
+        <reference source="CCE" ref_id="{2}"/>
+        <reference source="macos_security" ref_id="{3}"/>
+        <description>{4}</description>
+      </metadata>
+      <criteria>
+        <criterion comment="{3}" test_ref="oval:mscp:tst:{5}"/>
+      </criteria>
+    </definition>'''.format(x,rule_yaml['title'],cce,rule_yaml['id'] + "_" + odv_label,escape(rule_yaml['discussion']).rstrip(),x)
+
+
+                if "$CURRENT_USER" in rule_yaml['check']:
+                    rule_yaml['check'] = '''CURRENT_USER=$(/usr/bin/defaults read /Library/Preferences/com.apple.loginwindow.plist lastUserName)
+{}'''.format(rule_yaml['check'])   
+
+                
+                oval_test = oval_test + '''
+    <shellcommand_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mscp:tst:{0}" version="1" comment="{1}_test" check_existence="all_exist" check="all">
+      <object object_ref="oval:mscp:obj:{0}"/>
+      <state state_ref="oval:mscp:ste:{0}"/>
+    </shellcommand_test>'''.format(x,rule_yaml['id'] + "_" + odv_label)
+                oval_object = oval_object + '''
+  
+    <shellcommand_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mscp:obj:{0}" version="1" comment="{1}_object">
+     <shell>zsh</shell>
+     <command>{2}</command>
+    </shellcommand_object>'''.format(x,rule_yaml['id'] + "_" + odv_label,escape(rule_yaml['check']).rstrip())
+
+                
+
+                
+                if count_found:
+                    if check_existance != "none_exist":
+                        oval_state = oval_state + '''
+    <shellcommand_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mscp:ste:{0}" version="1" comment="{1}_state">
+      <stdout_line operation="pattern match">.*</stdout_line>
+    </shellcommand_state>'''.format(x,rule_yaml['id'] + "_" + odv_label)
+                    else:
+                        oval_state = oval_state + '''
+    <shellcommand_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mscp:ste:{0}" version="1" comment="{1}_state">
+      <stdout_line check_existence="none_exist" />
+    </shellcommand_state>'''.format(x,rule_yaml['id'] + "_" + odv_label)
+                    
+                else:
+                    oval_state = oval_state + '''
+    <shellcommand_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:mscp:ste:{0}" version="1" comment="{1}_state">
+      <stdout_line operation="equals">{2}</stdout_line>
+    </shellcommand_state>'''.format(x,rule_yaml['id'] + "_" + odv_label,check_result)
+                x += 1
+                check_existance = "all_exist"
+                continue
+            x += 1
     for k in generated_baselines.keys():
         xccdf_profiles = xccdf_profiles + '''
         <Profile id="xccdf_gov.nist.mscp.content_profile_{1}">
@@ -3349,14 +642,14 @@ def generate_scap(all_rules, all_baselines, args, stig):
         </Group>  </Benchmark>
   </component>  
   <component id="scap_gov.nist.mscp.content_comp_macOS_{1}_check_1" timestamp="{0}">
-    <oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="   http://oval.mitre.org/XMLSchema/oval-definitions-5             https://raw.githubusercontent.com/OVALProject/Language/5.11.2/schemas/oval-definitions-schema.xsd  http://oval.mitre.org/XMLSchema/oval-definitions-5#independent https://raw.githubusercontent.com/OVALProject/Language/5.11.2/schemas/independent-definitions-schema.xsd    http://oval.mitre.org/XMLSchema/oval-definitions-5#macos       https://raw.githubusercontent.com/OVALProject/Language/5.11.2/schemas/macos-definitions-schema.xsd  http://oval.mitre.org/XMLSchema/oval-definitions-5#unix        https://raw.githubusercontent.com/OVALProject/Language/5.11.2/schemas/unix-definitions-schema.xsd">
+<oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5 https://raw.githubusercontent.com/OVAL-Community/OVAL/master/oval-schemas/oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent https://raw.githubusercontent.com/OVAL-Community/OVAL/master/oval-schemas/independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#macos https://raw.githubusercontent.com/OVAL-Community/OVAL/master/oval-schemas/macos-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix https://raw.githubusercontent.com/OVAL-Community/OVAL/master/oval-schemas/unix-definitions-schema.xsd">
       <generator>
-        <oval:schema_version xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5">5.11.2</oval:schema_version>
+        <oval:schema_version>5.12.1</oval:schema_version>
         <oval:timestamp xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5">{0}</oval:timestamp>
-        <terms_of_use>Copyright (c) 2020, NIST.</terms_of_use>
+        <terms_of_use>Copyright (c) {2}, NIST.</terms_of_use>
         <oval:product_name xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5">macOS Security Compliance Project</oval:product_name>
       </generator>
-'''.format(date_time_string,version_yaml['os'])
+'''.format(date_time_string,version_yaml['os'],year)
     total_oval = "\n<definitions>\n" + oval_definition + "\n</definitions>\n<tests>\n" + oval_test + "\n</tests>\n<objects>\n" + oval_object + "\n</objects>\n"
     if oval_state != "":
         total_oval = total_oval + "<states>\n" + oval_state + "\n</states>\n"
@@ -3421,10 +714,10 @@ def generate_scap(all_rules, all_baselines, args, stig):
     </cpe-list>
   </component>
   <component id="scap_gov.nist.mscp.content_comp_macOS_{2}_macOS-cpe-oval.xml" timestamp="{0}">
-    <oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation=" http://oval.mitre.org/XMLSchema/oval-definitions-5 https://raw.githubusercontent.com/OVALProject/Language/5.11.2/schemas/oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent https://raw.githubusercontent.com/OVALProject/Language/5.11.2/schemas/independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#macos https://raw.githubusercontent.com/OVALProject/Language/5.11.2/schemas/macos-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix https://raw.githubusercontent.com/OVALProject/Language/5.11.2/schemas/unix-definitions-schema.xsd">
+    <oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5 https://raw.githubusercontent.com/OVAL-Community/OVAL/master/oval-schemas/oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent https://raw.githubusercontent.com/OVAL-Community/OVAL/master/oval-schemas/independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#macos https://raw.githubusercontent.com/OVAL-Community/OVAL/master/oval-schemas/macos-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix https://raw.githubusercontent.com/OVAL-Community/OVAL/master/oval-schemas/unix-definitions-schema.xsd">
       <generator>
         <oval:product_name>macOS Security Compliance Project</oval:product_name>
-        <oval:schema_version>5.11.2</oval:schema_version>
+        <oval:schema_version>5.12.1</oval:schema_version>
         <oval:timestamp>{0}</oval:timestamp>
       </generator>
       <definitions>
@@ -3471,11 +764,7 @@ def generate_scap(all_rules, all_baselines, args, stig):
     </oval_definitions>
   </component>
 </data-stream-collection>'''.format(date_time_string,version_yaml['cpe'],version_yaml['os'])
-    # total_scap = total_scap.replace("&", "&amp;")
-    # total_scap = total_scap.replace("<", "&lt;")
-    # total_scap = total_scap.replace(">", "&gt;")
-    # total_scap = total_scap.replace("\"", "&quot;")
-    # total_scap = total_scap.replace("'", "&apos;")
+
     scap_file = output
     with open(scap_file + "temp",'w') as rite:
         if export_as == "scap":
@@ -3494,7 +783,7 @@ def generate_scap(all_rules, all_baselines, args, stig):
             except:
                 print("Error writing Oval file.")
         else:
-            cmd = cmd + " " + scap_file + "temp --format --output " + scap_file
+            cmd = cmd + " " + scap_file + "temp --huge --format --output " + scap_file
             
             os.popen(cmd).read()
             if os.path.exists(scap_file):
@@ -3673,6 +962,8 @@ def collect_rules():
             rule_yaml['tags'].remove("i386")
         if "arm64" in rule_yaml['tags']:
             rule_yaml['tags'].remove("arm64")
+        if "srg" in rule_yaml['tags']:
+            rule_yaml['tags'].remove("srg")
 
         all_rules.append(MacSecurityRule(rule_yaml['title'].replace('|', '\|'),
                                     rule_yaml['id'].replace('|', '\|'),
@@ -3736,10 +1027,6 @@ def main():
 
     all_rules_pruned = []
 
-    # for rule in all_rules:
-    #     if rule.rule_id not in all_rules_pruned:
-    #         all_rules_pruned.append(rule.rule_id)
-
     if args.list_tags:
         for tag in available_tags(all_rules):
             print(tag)